Security
How does JamCash keep my data safe?
JamCash reads your bank through SimpleFIN Bridge, which is read only, so it can never move money, and it never sees your bank password. The access link SimpleFIN issues is encrypted with AES-256-GCM before storage. API keys are stored only as SHA-256 hashes, and every key is scoped and revocable.
What protects each part of JamCash?
| Area | Control |
|---|---|
| Bank access | Read only, through SimpleFIN Bridge. JamCash cannot move money. |
| Bank password | Never seen or stored by JamCash. It stays with SimpleFIN Bridge. |
| Bank access link | Encrypted with AES-256-GCM before it is stored; deleted when you unlink. |
| Sign-in session | HttpOnly, SameSite cookie, Secure over HTTPS, with a CSRF token on every change. |
| Sign-in attempts | Rate limited per address. |
| API keys | Shown once; stored as a SHA-256 hash; scoped, expirable and revocable. |
| AI assistants | Only the tools a key’s scopes allow; no tool can touch the bank link. |
Security questions
How will JamCash protect my bank connection?
JamCash never sees your bank password. SimpleFIN Bridge holds the bank login; JamCash stores only the read-only access link SimpleFIN issues, encrypted with AES-256-GCM before it is written to the database. Unlinking deletes it, and a new setup token is needed to reconnect.
How are API keys protected?
API keys are shown once, when you create them. JamCash stores only a SHA-256 hash of each key plus a short prefix for recognition. Each key has scopes (read, write, or bank administration), an optional expiry and a last-used time, and can be revoked at any moment.