Read-only by design
Last updated
Shelter cannot move your money. It cannot store your bank password. It cannot sell your data. Here are the receipts.
The short list
No transfers. No password. No card.
These are absences, not promises. There is no endpoint in the codebase that can move your money, store a bank password, or process a card.
Read the code
Four receipts, each pointing at the file that ships it.
How we connect
Shelter opens a Plaid Link flow. Plaid handles the bank login. Plaid returns a read-only access token. Shelter never sees your bank password.
Source file: convex/
How we store the token
Before the Plaid access token is written to the database, it is encrypted with AES-256-GCM. A fresh random IV is generated per token and the auth tag is stored alongside the ciphertext.
Source file: convex/
How you sign in
Authentication is handled by Clerk. Shelter validates a Clerk-issued JWT on every request. Your password is held by Clerk; Shelter never stores it.
Source file: convex/
How payment works
Card details are entered into Stripe, not Shelter. Shelter only stores a Stripe customer id and subscription status. Your card number never reaches our servers.
Source file: convex/
How we serve the page
shelter.money is served over TLS, terminated by Railway. The web app sets the following response headers on every route:
Content-Security-Policy is enforced on every route alongside HSTS, frame restrictions, MIME sniffing protection, a strict referrer policy, and a permissions policy.
Source file: web/
Step by step
You tap "Link bank" inside Shelter.
Plaid takes over. You enter your bank credentials with Plaid, not Shelter.
Plaid returns a read-only access token. Shelter encrypts it before storing it.
Shelter reads balances and transactions. There is no write path.
For Plaid's own security practices, read Plaid's trust and safety resources.
The same three commitments that live on the homepage.
Isolation
Every Shelter user's accounts, transactions, and forecasts are scoped by user id at the database layer. No table query returns another user's data. There is no shared pool, no aggregate sold to a partner, no analytics warehouse with your transactions.
Business model
Shelter is funded by subscriptions. There is no ad code in the app, no affiliate links to financial products, and no analytics partner that sees your transactions. The only way Shelter makes money is if you pay for it.
Trust is asymmetric
Things Shelter has not done yet.
Trust is asymmetric. The rest of this page lists what we have done. This panel lists what we haven't. If a security review needs more than what's on this list, we're probably not the right vendor yet.
Every claim on this page is backed by code that ships in the product today. So is every line above.
Vulnerability disclosure
Email support@shelter.money with a clear description and reproduction steps. We'll acknowledge on a best-effort basis within 5 business days. We don't run a formal bug bounty today, but we read every report.
Source file: .well-known/
Questions, answered
No. There is no transfer or payment endpoint in the codebase. The Plaid connection is opened in read-only mode and only returns balances and transactions.
No. Your bank credentials are entered with Plaid during the link flow. Shelter only receives a read-only access token afterward.
Encrypted with AES-256-GCM with a fresh random initialization vector and an authentication tag per token before it is written to the database.
Authentication is handled by Clerk. Shelter validates a Clerk-issued JWT on every request. Your password is held by Clerk; Shelter never sees or stores it.
Card data is entered into Stripe’s hosted checkout, not Shelter. Shelter stores a Stripe customer id and subscription status. Your card number never reaches Shelter’s servers.
Yes. You can unlink the bank from inside Shelter or from your bank’s third-party access settings. Revoking on either side severs Shelter’s read access immediately.
Email support@shelter.money. We read every message that comes in.
We read every email. If a security claim on this page doesn't match what you see in the product, tell us.
