Security
Authentication
Sign-in is handled by Supabase Auth (email and password), with optional authenticator-app two-factor. Every request to our API must carry a valid session token (JWT), which the server verifies against Supabase's public signing keys before returning any data.
Encryption in transit
All traffic between your browser, our API, and the database is encrypted over HTTPS/TLS.
Encryption at rest
Sensitive statement fields — the account label, transaction narration, merchant, reference numbers, and running balance — are encrypted with AES-256-GCM before being stored, using a key held outside the database. Only the transaction date, amount, type, and category are stored unencrypted, so the app can compute your summaries.
Data isolation
Every record is tied to your user account. Database Row-Level Security enforces that you can only ever read or modify your own data, never another user's.
Payment credentials
We never see your card or UPI details: they are entered on Razorpay's own payment form. Every payment is confirmed server-side against a signature from Razorpay before it changes anything on your account.
Session hygiene
The app signs you out in your browser after 5 minutes of inactivity. This is a client-side convenience that reduces the risk from an unattended screen; it clears the session locally but does not by itself revoke the token server-side, which remains valid until it expires. Always sign out and lock your device on shared computers.
Third-party processing
The only external service that ever receives transaction content is Anthropic's API, and only when you explicitly use the optional AI features.
Reporting an issue
Found a vulnerability? Please report it to support@lekhalens.com.
This document describes how LekhaLens works and is provided for information. It is not legal advice.