Risk assessment
Keeping a household's money records in one place is useful precisely because it is concentrated — and that is also what makes it a risk. This page sets out the main risks we see in running Fincraft, how serious we judge them, and what is done about each. It is reviewed at least once a year and whenever a feature changes what is stored.
Last updated 1 November 2026
This document is not ready to publish.
It names no legal party because these are not set on this installation:
LEGAL_OPERATOR, LEGAL_ADDRESS, LEGAL_GOVERNING_LAW, LEGAL_JURISDICTION, LEGAL_CONTACT_EMAIL.
Set them in .env and the wording below completes itself.
See config/legal.php.
How to read it
Likelihood and impact are judged before the safeguards, so the rating shows why the safeguard is there. The safeguards listed are the ones the software actually has today, not intentions.
| Risk | Rating | What is done about it |
|---|---|---|
| Someone else signs in to your account — a reused or guessed password, a phished link, a shared device. | High | Passwords hashed with bcrypt; sign-in, registration and reset rate-limited; free two-factor authentication on every plan; a list of active sessions you can end; reset links that expire in 60 minutes and work once; no answer that reveals whether an address has an account. |
| A breach of the database exposes account numbers, nominees or identity numbers. | High | The most sensitive fields are encrypted with a separate data key held outside the database; HTTPS only; encrypted backups; a separate database for Fincraft; restricted, logged operator access. See the data protection policy. |
| One household sees another's records. | High | Every query is scoped to the household; the boundary is covered by automated tests that run on every change. |
| A household member sees more than they should — for example who is named as nominee. | Medium | Roles per household; nominee and document screens behind their own permissions; an accountant can be given read-only access; an audit trail of changes. |
| A figure is relied on as advice — a forecast, return, tax estimate or "available to spend" taken as a recommendation. | Medium | The disclaimer explains what each kind of figure can and cannot tell you; no product is recommended, sold or promoted; nothing is presented as a regulated service. |
| A wrong figure from wrong input — a statement mis-read, a duplicate import, a stale price or exchange rate. | Medium | Imports are previewed before they are saved, with duplicate detection; reconciliation against statement balances; every transaction can be corrected on screen; prices and rates show their date. |
| Losing your records — an accidental deletion, a failed server, the service closing. | Medium | Encrypted backups before every update and every night, with monthly and yearly copies kept for up to ten years and each checked to be restorable; export of everything as JSON at any time, including after you cancel; at least 90 days' notice and working export if the service ever closes. |
| A fraudulent payment request — someone posing as Fincraft asks for card details or a payment to a different account. | Medium | We never ask for card numbers, PINs or OTPs; invoices come only by email from us; the payment policy tells you how to check. |
| Uploaded statements and documents carry more than is needed, or a malicious file. | Medium | Statements are read for transactions and not kept as a document unless you choose to store one; password-protected PDFs are opened with the password you give for that import only; files are stored privately, never on a public address; storage limits per plan. |
| Third parties learn what you do — trackers, advertising, analytics. | Low | No advertising; Google Analytics counts visits but never receives your financial records; a Content-Security-Policy that allows no other outside origin; no data sold or shared. |
| Unexpected charges — a renewal you did not plan for. | Low | Yearly billing with an invoice before renewal; 30 days' notice of price changes; cancel any time; a 14-day refund window on every payment — see the refund policy. |
What you can do
- Turn on two-factor authentication, and use a password you use nowhere else.
- Give household members and your accountant the narrowest role that works.
- Reconcile accounts against your bank statements from time to time.
- Export your data now and then and keep the file somewhere safe.
- Treat every projection as a starting point for a conversation with a qualified adviser, not as the conclusion.
Tell us about a risk
If you think something in Fincraft could cause harm — a security weakness, a misleading figure, a confusing screen — write to [not set]. Responsible security research is welcome; tell us first and we will not pursue you for testing agreed in advance.