Security

Last updated 1 November 2026

How we protect your data.

Passwords

We never store your password itself, only a strong, salted one-way hash that can't be reversed to recover it. Even we can't see your password.

Two-factor authentication

Two-factor authentication, a code from an authenticator app in addition to your password, is required for platform administrators and for admins of business workspaces, and available to everyone else who would like the extra protection.

Sessions

Signing out ends that device's session immediately: a copied or stolen session cookie stops working right away. Changing your password ends every other session on your account, so a device you no longer trust is signed out automatically. If an administrator deactivates an account, every session on it ends immediately too.

Your data, on demand

Workspace admins can download a complete copy of their workspace's data, accounts, transactions, categories, budgets, ledger and audit history, as a file at any time, from the account menu.

Backups

Your data is backed up automatically every day. Each backup is encrypted before it ever leaves our server, and the decryption key is kept offline, so a stolen backup is unreadable without it. Backups are stored somewhere our own server has no ability to delete or alter, even if it were compromised. We've tested restoring from a backup and confirmed it matches production exactly. Deleted data can remain in encrypted backups for up to 180 days, until the backups holding it expire.

Account deletion

You can request deletion of your account at any time from the account menu ("Request account deletion"). We'll follow up by email, and complete it within 30 days.

Who else handles your data

Payments are handled by Stripe. We never see or store your full card number. If you use "Ask AI," the relevant data for that request is sent to Google's Gemini service. Our servers and email delivery are provided by Oracle Cloud Infrastructure. See our Privacy Policy for the full picture.

Hosting

Caltash is hosted on Oracle Cloud Infrastructure in India West (Mumbai). Disk storage is encrypted using Oracle-managed keys. All traffic is encrypted in transit via HTTPS.

Found a security issue?

Email support@caltash.com. We take security reports seriously and will respond promptly. See also /.well-known/security.txt.