Security
Your financial data, handled plainly and carefully
Here is exactly what we store, how long we keep it, who can see it, and what we can and cannot do with your accounts. No vague assurances.
Read-only
We cannot move money or edit your books.
Encrypted
TLS 1.2+ in transit, AES-256 at rest.
Retention
Deleted within 30 days of closure.
Least access
Staff access is logged and time-bound.
Data handling
What is stored, for how long, and why
| Data | Why we store it | Retention |
|---|---|---|
| Bank transactions | Burn, runway and forecasting | While your account is active, deleted within 30 days of closure |
| Ledger entries and invoices | Categorisation, collections forecasting and reconciliation | While active, deleted within 30 days of closure |
| Payment platform payouts | Matching inflows to revenue | While active, deleted within 30 days of closure |
| Connection tokens | Keeping data in sync | Revoked and deleted on disconnect |
| Bank login credentials | Not stored | Never received by Morgonplex |
| Generated reports | Your board pack history | Until you delete them or close the account |
| Backups | Disaster recovery | Encrypted, rotated out within 35 days |
Read-only connections
What read-only means, in plain terms
Every connection is set up with the narrowest read permission the provider offers. Bank data arrives through consent-based aggregators or feeds, so your banking password is never shared with us.
- We cannot initiate payments or transfers
- We cannot create, edit or delete ledger entries
- You can revoke any connection from settings at any time
- Revoking stops syncing immediately
Encryption and infrastructure
- TLS 1.2 or higher for all traffic
- AES-256 encryption at rest for databases and backups
- Tokens stored in a separate encrypted secrets store
- Hosted in India region data centres
- Production access limited to named engineers, with audit logs
Compliance posture
Where we stand today
We would rather state our current position accurately than list badges we have not earned.
| Area | Current status |
|---|---|
| Digital Personal Data Protection Act, 2023 | Policies and processes aligned, reviewed as rules are notified |
| SOC 2 Type II | Not yet certified Controls being implemented |
| ISO 27001 | Not yet certified |
| Penetration testing | Planned annually by an independent firm |
| Responsible disclosure | Report issues through our contact page |
Decision support, not advice. Morgonplex provides forecasting and scenario modeling to support your decisions. It is not formal financial, tax or legal advice. For those, please consult a qualified professional.
Have a security question we did not answer?
Our team will walk you through anything your auditor, investor or IT lead needs to know.