Security & Data Protection

The Planning App uses safeguards that include:

Secure authentication

Only authenticated users can access the application.

Role-based permissions

Access is determined by each user’s role and responsibilities.

Household-level data isolation

Client information is separated by household using database-level security policies.

Encrypted communications

Information transmitted between your browser and the application is protected using HTTPS/TLS encryption.

Protected document storage

Uploaded documents are stored in secured, access-controlled cloud storage.

Server-side authorization

Sensitive requests are verified by the server and do not rely solely on browser-side controls.

Input validation

Information submitted to the application is validated before it is processed.

Environment separation

Production information is kept separate from development and testing environments.

Secure cloud infrastructure

The application operates on professionally managed cloud infrastructure with established physical, network, and operational security controls.

Security-focused testing and reviews

Application changes are tested and reviewed before release.

Ongoing maintenance

Security controls and software dependencies are reviewed and updated as the platform evolves.

Our development and security practices are informed by OWASP guidance, including the OWASP Top 10, a widely recognized framework covering common web application security risks.

These practices help us address risks such as:

• 
  Unauthorized access
• 
  Broken access control
• 
  Injection attacks
• 
  Cross-site scripting
• 
  Authentication failures
• 
  Privilege escalation
• 
  Exposure of sensitive information
• 
  Malicious or improperly validated requests
• 
  Security configuration weaknesses

Following OWASP guidance means security is considered throughout application design, development, testing, and maintenance. It should not be interpreted as an OWASP certification, as OWASP does not certify individual applications.

No. Client information is isolated by household. Database-level security policies require the user to be both authenticated and authorized for the specific household before its information can be accessed.

These protections are enforced behind the application—not only through what appears on the screen.

No. Access is based on job responsibilities and household assignments. Clients, planners, assistants, managers, and administrators receive different permissions based on their roles.

Administrative access is restricted to authorized personnel who require it to operate, maintain, or support the platform.

Documents are stored in secured cloud storage and are not intended to be publicly accessible. Access requires authentication and is evaluated against the user’s permissions and relationship to the applicable household.

Sensitive operations are independently verified by the server. The application does not assume that a user is authorized simply because a button, page, household identifier, or document link appears in their browser.

Authorization is checked again before protected information is accessed or changed.

Security is incorporated throughout the software development lifecycle. New functionality is designed and reviewed with attention to common application-security risks, including:

• 
  Unauthorized access to another household’s information
• 
  Improper changes to user permissions
• 
  Malicious or invalid input
• 
  Cross-site scripting
• 
  Cross-site request forgery
• 
  Server-side request forgery
• 
  Accidental exposure of confidential information
• 
  Insecure handling of credentials and configuration secrets

Changes also undergo automated code-quality checks, type validation, and testing before release.

No online platform can guarantee absolute security. We use layered safeguards and industry-recognized practices designed to reduce risk, prevent unauthorized access, and protect client information.

We continually evaluate these protections as the application and the security landscape evolve.