Security
Last updated: September 29, 2026
The short version
The safest data is data we never have. IncomeSync never asks for your bank login, and your household's finances are never uploaded to our servers. They stay on your computer, encrypted. If our servers were ever breached, there would be no paychecks, balances or bills there to take.
On your computer
- Encrypted app data. Everything you enter is kept in an encrypted file (AES-256-GCM). The key is protected by Windows for your Windows account, so the file can't be opened from another account or another computer.
- Encrypted backups. An encrypted backup is saved each time you close the app, and the last 10 are kept. Your recovery key opens them on a new computer; keep it somewhere safe, like a password manager.
- A locked-down app. The app window runs in a sandbox, can't browse to other websites, and opens links only to IncomeSync, Google and Stripe in your browser.
- Sign-in in your browser. You sign in with Google in your own browser, and the app never sees your Google password.
On our servers
Our servers (Google Firebase) keep only what's needed to sign you in and bill your subscription:
- Your name, email address, phone number and mailing address
- Your Google account identifier and sign-in times
- Your subscription status, trial end date and next billing date, plus your Stripe customer ID
- Support requests you choose to send
Database rules let each person reach only their own record, and billing fields can be changed only by our payment system, never from the app or website. We never store Social Security numbers, bank logins, card numbers, employers, pay or any household financial details.
Payments
Payments are handled by Stripe, a PCI DSS Level 1 certified payment provider. Your card number is entered on Stripe's checkout page and never reaches IncomeSync.
In transit
Everything sent between the app, the website and our servers uses HTTPS. The website sends strict security headers, including HSTS and a Content Security Policy.
What you control
When you sync events to Google Calendar, export a file, or share a backup and recovery key, that information goes where you send it. Protect the Google account you connect, and share calendars and backups only with people you trust. Our Privacy Policy explains this in full.
Reporting a security issue
If you think you've found a security problem in IncomeSync, email support@incomesync.app with "Security report" in the subject. Please include steps to reproduce it and give us a reasonable time to fix it before sharing it publicly. We'll confirm we received your report within 3 business days.