Security

Where your records live

Every record belongs to the business owner's own Neuctra Authix account. Only the Neuctra Finance server talks to Authix, using a secret key that never reaches a browser. The dashboard and your integrations both go through the server.

Nothing is stored in the dashboard itself. Sign-in uses a signed, HttpOnly cookie that scripts on the page cannot read.

Signing in

Your email must be verified before any record can be created. Creating keys, webhooks or share links, approving spending, closing the books, and deleting a business or your account all ask for your password again if you have not entered it in the last 10 minutes.

You can sign out on every device at once. Changing your password does it for you.

API keys

A key is shown once. Only a fingerprint (SHA-256 hash) is stored, so even we cannot show it again.

Each key can be limited to some permissions, some accounts, an amount per transaction, an amount it may reserve, a list of server addresses and an expiry date. Server keys are refused from browsers, and browser keys only work from the websites you list. Every key is rate limited.

A ledger that cannot be quietly changed

An account never goes below zero. A retried request with the same idempotency key is never charged twice.

Transactions are never edited or deleted. A mistake is undone with a reversal that points to the original. Closed months cannot be posted into. A balance check compares every balance with its full history.

The audit log records who did what, and when.

Teams

Each person has a role, from admin to read-only viewer, and can be limited to some accounts and an amount per transaction. Nobody can approve their own spending request.

An invite only works for the email address it was sent to, once, within 7 days. When someone is removed, the keys and share links they made stop working.

Webhooks and share links

Every webhook is signed with your endpoint's secret and a timestamp, so your systems can check it came from us and is fresh. Webhooks cannot be pointed at private network addresses.

A share link's secret sits after the # in the address, which browsers never send to any server or in a referrer. Links expire, can be turned off at any time, count their views and are never indexed by search engines.