Security Overview

All connections to Homina use TLS encryption. Data at rest is stored with an access-controlled cloud provider and protected by row-level security so each user can only read their own records and the pods they belong to.

Chat messages between pod members are end-to-end encrypted. Homina stores only the encrypted form and the metadata needed for delivery — we cannot read your conversations.

Users can enable TOTP-based two-factor authentication (Google Authenticator, 1Password, Authy). When enabled, a verification code is required at every sign-in before the account can be accessed. Single-use backup codes are provided and stored only as SHA-256 hashes.

Security-relevant actions are recorded in an audit log retained for 3 years. API endpoints are protected by rate limiting to prevent abuse and brute-force attacks.

Bank connections are established through Plaid. Homina never stores your bank credentials. Account and transaction data fetched through Plaid is deleted within 14 days of unlinking a bank, and you can revoke Homina’s access at any time from your Plaid Dashboard.

Payment information is handled by Stripe; Homina does not store full card numbers on its servers. Billing records are retained for 7 years to meet legal and tax obligations.