For vendor diligence

Security at Nalo.

This page summarizes security controls that are verifiable in Nalo’s current product and code. It is intended to support bookkeepers documenting vendor diligence for a Written Information Security Plan. It is not a certification or audit report.

Encryption and bank connections

Nalo protects data with TLS 1.2+ in transit and AES-256 at rest on Google Cloud Platform, which maintains SOC 2 Type II compliance. Nalo does not claim independent SOC 2 certification.

Bank credentials never touch Nalo. You enter them directly in Plaid’s interface. Nalo receives access tokens that allow it to retrieve financial data, never your bank password.

Two-factor authentication

Signed-in users can enroll an authenticator app using time-based one-time passwords. Once enrolled, sign-in requires a 6-digit authenticator code. Nalo also generates recovery codes after enrollment and stores their scrypt hashes, not the plaintext codes.

Client isolation and access enforcement

Nalo’s multi-client record paths are scoped by the authenticated owner’s user ID and a business ID. That business ID remains part of bookkeeping, review, receipt, and close-readiness records.

Firebase security rules restrict user records to the matching authenticated user. Authenticated server endpoints verify a Firebase ID token. Business endpoints derive the owner identity from that verified token and validate a requested business scope before using it.

Audit records

Nalo’s backend records audit events for sensitive operations, including data exports, account deletion, MFA recovery actions, business categorization, and close-review acknowledgments. Audit writes are best-effort by design: a failed audit write never blocks the underlying operation.

Data export and deletion

Nalo provides an authenticated, machine-readable data export of core account records toward GDPR data portability; coverage is being extended to every nested record, and receipts remain individually downloadable. Users can also delete their account from the app. The deletion path revokes each connected Plaid item, or durably queues a revocation retry, before recursively deleting the user’s Firestore subtree and receipt files and deleting the authentication account. An account-deletion audit event is intentionally retained.

Report a security concern

To report a suspected breach, vulnerability, or other security issue, email security@nalo.app.