ENCRYPTION
TLS everywhere, AES-256 at rest.
All data in transit uses TLS 1.2+. Data at rest in Azure SQL is encrypted with AES-256. Keys are managed by Azure Key Vault.
AUTHENTICATION
Microsoft Entra External ID.
Sign-in is handled by Microsoft's identity platform. We never see your password. Tokens expire. Sessions timeout.
INFRASTRUCTURE
Azure serverless. No public-facing VMs.
The API runs on Azure Functions. There are no servers to patch, no SSH ports open, no attack surface beyond the API itself.
RAW FILE DATA
Your CSV is deleted after processing.
We parse the file, categorise the transactions, then delete the raw CSV immediately. We store only the structured data.
BANK ACCESS
We never have it.
Handled is not a bank. We can't see your accounts, initiate payments, or authenticate to your bank on your behalf. CSV upload is intentional.
PAYMENTS
Stripe handles all billing.
We never see your card number. Stripe is PCI DSS Level 1 certified. Subscription management goes through Stripe's hosted portal.
YOUR DATA
Export and delete any time.
You can export all your data as CSV from the app at any time. Deleting your account removes everything within 30 days.
PRIVACY ACT
Compliant with the NZ Privacy Act 2020.
We collect only what's needed to run the service. We don't sell data. We don't share data with third parties for advertising.