Security

Built with security as a baseline

Fignis is used to model sensitive financial decisions, so we protect your data with strong encryption, hardened browser controls, secure authentication, account boundaries, disciplined operations, and a clear rule: we do not and never will sell your data.

Security

How we protect your data

Externally tested web security

Fignis scores A+ on SSL Labs and Security Headers, plus 10/10 on MDN Observatory. For you, that means the connection and browser rules around your planning workspace are tested against public standards for modern HTTPS, strong TLS, HSTS, restrictive content loading, MIME-sniffing protection, and careful cross-origin controls.

Many sites stop at basic HTTPS. Fignis goes further by making these controls explicit, measurable, and continuously verifiable with independent public scanners.

Strong encrypted connections

Your browser connects to Fignis over HTTPS with a hardened TLS configuration, so the financial assumptions you enter are encrypted while they travel between your device and Fignis.

TLS encrypts the connection between your browser and Fignis. We support only current TLS versions, so weaker connection methods are not accepted.

Hardened browser protections

Fignis sends security headers that tell your browser which resources may load, where pages may be embedded, and how sensitive content should be handled, reducing the chance that another site can interfere with your planning session.

These controls reduce exposure to content injection, clickjacking, MIME-type confusion, and cross-origin leakage.

Secure access

Fignis supports social login and email-based accounts, so you can sign in without sharing financial account credentials.

For email-based accounts, passwords are protected using one-way hashing and salting before they are stored. For Google sign-in, Fignis never receives or stores your Google password; Google verifies your identity and Fignis uses that verified sign-in to create a secure session.

Database and data security

Your planning data is separated by account in the application and database access layer, so it stays within the account it belongs to unless access is intentionally shared.

We treat this information as private financial planning data, use it only to provide, secure, support, and improve the service, and do not and never will sell your data.

Operational discipline

Fignis stores and manages its application data on infrastructure we control, instead of relying on shared third-party application platforms for core data handling.

We limit access to systems and credentials, manage infrastructure through controlled processes, monitor reliability and security signals, and review changes before they reach users.

Security is continuously maintained

Security scores are useful because they make important controls visible and testable.

We treat them as a baseline to maintain, not a one-time badge. As standards evolve, we review our configuration and update it where needed.

Contact

For security questions or vulnerability reports, email us at Fignis [email protected] .