For vendor diligence
This page summarizes security controls that are verifiable in Nalo’s current product and code. It is intended to support bookkeepers documenting vendor diligence for a Written Information Security Plan. It is not a certification or audit report.
Nalo protects data with TLS 1.2+ in transit and AES-256 at rest on Google Cloud Platform, which maintains SOC 2 Type II compliance. Nalo does not claim independent SOC 2 certification.
Bank credentials never touch Nalo. You enter them directly in Plaid’s interface. Nalo receives access tokens that allow it to retrieve financial data, never your bank password.
Signed-in users can enroll an authenticator app using time-based one-time passwords. Once enrolled, sign-in requires a 6-digit authenticator code. Nalo also generates recovery codes after enrollment and stores their scrypt hashes, not the plaintext codes.
Nalo’s multi-client record paths are scoped by the authenticated owner’s user ID and a business ID. That business ID remains part of bookkeeping, review, receipt, and close-readiness records.
Firebase security rules restrict user records to the matching authenticated user. Authenticated server endpoints verify a Firebase ID token. Business endpoints derive the owner identity from that verified token and validate a requested business scope before using it.
Nalo’s backend records audit events for sensitive operations, including data exports, account deletion, MFA recovery actions, business categorization, and close-review acknowledgments. Audit writes are best-effort by design: a failed audit write never blocks the underlying operation.
Nalo provides an authenticated, machine-readable data export of core account records toward GDPR data portability; coverage is being extended to every nested record, and receipts remain individually downloadable. Users can also delete their account from the app. The deletion path revokes each connected Plaid item, or durably queues a revocation retry, before recursively deleting the user’s Firestore subtree and receipt files and deleting the authentication account. An account-deletion audit event is intentionally retained.
To report a suspected breach, vulnerability, or other security issue, email security@nalo.app.