Draft · operator and qualified counsel review required
Security and Responsible Disclosure Notice
Describes verified controls without claiming certification or invulnerability.
- Version:
- DRAFT-2026-10-12
- Effective:
- [EFFECTIVE_DATE]
- Updated:
- 2026-10-12
- Language:
- EN
Current controls
The reviewed build uses invitation-only authentication, password and MFA support, session revocation, workspace-scoped authorization, validation, security headers, redacted errors, audit records and verified backups.
Known limitations
No claim of SOC 2, ISO 27001, penetration-test certification or perfect security is made. Local SQLite databases and managed backups are not encrypted by FinPosition at the application layer.
Report a vulnerability
Report suspected vulnerabilities privately to [SECURITY_CONTACT]. Do not access another person's data, degrade service, use social engineering or retain unnecessary data. A formal safe-harbor decision requires counsel.