Security

Pairly does not connect to your bank accounts. There is no bank credential to steal, no stored login to a financial institution, and no live transaction feed running in the background. The only financial information Pairly holds is what somebody in your space typed into it on purpose.

That is a deliberate design decision rather than a missing feature, and it removes the single largest category of risk a budgeting product carries.

Access control

Every table in Pairly’s database uses PostgreSQL row-level security. Access is decided by the database itself on every single query, not by application code that could forget to check. A person can read or write data belonging to a Pairly Space only while they are a member of it, and removing somebody from a space removes their access in the same instant.

Sensitive operations that need to reach across those boundaries, such as accepting an invitation, run through named database functions with a fixed, audited scope rather than through a general-purpose key.

Payments

Card payments are handled entirely by Stripe. Card numbers are entered on Stripe’s own checkout, and Pairly’s servers never see, never receive and never store a card number, a CVC or an expiry date. Your subscription status reaches Pairly through Stripe’s signed webhooks, which are verified before anything is acted on.

Sign in

Accounts are handled by Supabase Auth. You can sign in with Google, in which case Pairly never handles a password at all, or with an email address and a password, which is hashed by the auth provider and is never stored by Pairly in a form anybody here can read. Every page and every request is served over HTTPS.

What other people in your space can see

Inside a shared space, members can see the shared month: the bills, the subscriptions, the goals and the split. They cannot see anything outside that space, they cannot see your bank accounts, because Pairly is not connected to them, and they cannot see anything you never entered. Marking an expense personal keeps it out of the split, though the other members can still see that it exists.

Getting your data out, and getting rid of it

Export takes a full copy at any time, with no subscription required. Delete removes the space and everything in it from one button in Settings, with no email to send, no waiting period and no retention window. Nothing is ever deleted because a trial ended, a subscription lapsed or a payment failed.

Reporting a problem

If you believe you have found a security issue in Pairly, tell us and we will take it seriously. Use the contact form and put “security” in the subject line, and it will be read the same day. Please give us a reasonable opportunity to fix an issue before making it public. We will not pursue anybody who reports a genuine problem in good faith.

What we will not claim

We will not tell you that Pairly is 100% secure, hacker-proof or bank-grade, because no product can honestly say any of that, and a company that does is telling you how it thinks about risk. We describe the protections we have actually built, we will say so plainly if that ever changes, and we hold no certification we have not been through.