Security
The strongest thing we can say about security is how little of your data we need in the first place. The rest follows from that.
Last updated 18 October 2026
Read-only by design
FXthom never moves money and never holds banking credentials. It analyses the commitments you describe; it does not act on them.
This is an architectural decision, not a policy one. The platform has no ability to initiate a payment, execute a trade or place a hedge, so there is no path from a compromised account to a moved dollar. When accounting integrations arrive they will use scoped, read-only OAuth — we will never ask for a password to another system.
What we never collect
We take only the fields an exposure calculation needs: currency, amount, timing, direction and the contract terms that govern them. The platform has no field for, and no way to store:
- Bank account, routing or IBAN numbers
- Card numbers or security codes
- Tax IDs, national insurance or social security numbers
- Passport or government identity documents
- Payroll records or employee personal data
Card details for a purchase go directly to Stripe and never reach our servers or our logs.
Tenant isolation
Separation between companies is enforced by the database itself, not by application code remembering to filter. Every table carries row-level security policies, so a query that should not see another company’s rows cannot — even if a bug upstream asked it to.
That is the difference between a check and a guarantee: application filters are code you can forget to write, and a policy at the data layer is not.
Getting in
Authentication runs on Supabase Auth. We never see or store your password. Two-factor authentication is available on every account using a standard authenticator app, and we recommend turning it on — Settings → Company.
Consequential actions are gated behind a second factor where that actually helps: the quiet, irreversible ones, rather than the everyday ones you would simply learn to click through.
An audit trail
Changes that matter are recorded — who changed what, and when — because a number you cannot explain to your auditor is not much use in a finance workflow. The log is yours to read.
Where it runs
Data is hosted in the United States on Supabase and Vercel, encrypted in transit and at rest by those providers. Payments run through Stripe, transactional email through Resend, and background document generation through Inngest. That is the complete list of companies that process your data, and it is also set out in the privacy policy.
Exchange rates come from the European Central Bank, which publishes them openly — a source we read, not a party we send anything to.
Where we are on certification
FXthom is not SOC 2 certified today. We would rather say so than let a page imply otherwise.
The architecture is built to the controls an audit looks for — tenant isolation, least-privilege data collection, audit logging, multi-factor authentication, a named subprocessor list — because those are worth having whether or not anyone is checking. Formal certification follows when the company is at the scale that warrants it. If you are evaluating us and need something specific for a vendor review, ask and we will tell you plainly what exists and what does not.
Reporting something
If you believe you have found a vulnerability, email info@fxthom.com with enough detail to reproduce it. We will acknowledge it, tell you what we find, and we will not pursue anyone who reports a genuine issue in good faith.
If we ever discover a breach affecting your data, we will tell you what happened and what it means for you.