Security / Specific facts

Keep the financial model.
Leave identity out.

Sightline stores financial records under opaque IDs. Identity stays at the sign-in provider. Financial records remain sensitive.

Data minimization

No PII fields
in the database.

The database has no direct identity fields. Use short aliases for people, entities, and accounts.

NO DIRECT IDENTITY FIELDS

  • Names
  • Email addresses
  • Street addresses
  • Telephone numbers
  • Birth dates
  • Government IDs
  • Account numbers
Sign-in identity

Clerk holds sign-in identity. The Sightline database holds opaque IDs. The service holds no Clerk key that can read identity. Plaid holds bank identity.

Agent text

A text filter rejects account numbers, email addresses, and telephone numbers in text that an agent writes. The filter cannot find every personal name.

Bank imports

The service filters text before storage. It does not store bank account names, account number masks, owner details, locations, or raw provider responses.

Sensitive records

Financial detail can identify a person without a direct identifier. Merchant text can still contain a name. Treat the records as sensitive.

One request. One household.

The database
enforces the boundary.

Row-level security checks a signed household context. A request cannot select a different household by record ID.

The service checks current member permissions and the client grant. It restricts records before totals. A restricted total states that it covers only the permitted selection.

Example grant · one corporation
{
  "entities": [
    "ent_demo_corporation"
  ],
  "account_types": "all",
  "detail": "full",
  "access": "read"
}
Revocation takes effect at the next request.

A request that already passed its access check can complete. Revocation cannot remove a copy that an external client already received.

Credentials & observability

Keep secrets out
of the record.

OAuth 2.1 with PKCE, dynamic client registration, and client ID metadata documents. Each client receives its own human-approved grant.

Bank tokens

Bank access tokens are encrypted. The encryption key stays outside the database.

OAuth tokens

The database stores token hashes. Refresh tokens rotate. A second use of one refresh token revokes the grant.

Logs

Logs hold request IDs, tool names, opaque IDs, error codes, and durations. No amounts, text fields, tokens, or provider payloads.

Client checks

PKCE uses S256. Authorization checks the exact redirect address and resource. The control page asks the human to check the redirect host or scheme.

Independent code review

Two reviews.
18 points.

Two independent security reviews found 18 points. Each point that needed code is corrected. The review record includes household isolation, consent, token reuse, data scope, and request limits.

Code review is not a compliance certification. Operator and account controls remain separate responsibilities.

Read privacy & deletion facts →Manage your client grants ↗