Security

Your records are yours

Every Indi account can only read and write its own records. Access is enforced at the database level with row-level security, so one account can never view or edit another user's income, expenses, invoices or receipts. Your data is never shared between accounts.

Encryption

Your data is transmitted over encrypted connections (HTTPS) and encrypted at rest by our hosting provider. This protects your records both while they travel between your device and Indi, and while they are stored.

Sign-in security

• Email and password — sign in with a password you choose. You can reset it any time if you forget it.
• Google sign-in — optionally sign in with your Google account, with Google handling that authentication step.
• Two-factor authentication — turn on a 6-digit authenticator code (TOTP) from Sign-in & security so that a password alone is never enough to access your account.
• Session revocation — if an account is suspended, active sessions are ended immediately and the user is signed out across devices.

Rate limiting & abuse protection

Sign-in, password reset, and form submissions are throttled on the server side to slow down brute-force attempts, credential stuffing, and spam. Repeated failed attempts are temporarily blocked before they can reach your account.

Share links you control

When you share a Tax Pack summary or an invoice, Indi creates a read-only link. Each link expires automatically after a set period, and you can revoke it at any time from the Tax Pack or Invoices page. Share activity is logged, so you can see when a link was opened. Shared summaries never include your receipts or invoice client details beyond what is needed to display the summary.

What Indi does not collect

• No bank logins, card details, or bank feed connections.
• No payment processing — the "Pay now" button on an invoice links to your own Stripe or PayPal account. Indi never sees, stores, or handles payment card data.
• No access to your accounting software or government accounts.

Keeping your account secure

A few simple steps make a big difference:

• Turn on two-factor authentication from Sign-in & security.
• Use a strong, unique password and a password manager.
• Keep the email account tied to your Indi sign-in secure.
• Revoke any share link you no longer need.

Reporting a security concern

If you believe you have found a security issue in Indi, please tell us rather than exploit it. Email support@app-indi.com with a short description of the issue. We take every report seriously and will look into it as a priority. Please give us reasonable time to investigate before sharing details publicly.

Changes to this page

Indi is in early access and this page may change as the product develops. We will update the date at the top of this page when it does.