Security

Updated October 12, 2026

Lasa holds some of the most sensitive information you have, so it's built to need as little access as possible and to protect what it does hold. Here's how.

Read-only by design

• Lasa can see the accounts you connect, but it cannot move money, pay bills or place trades. It doesn't request the account-number or payment products that would make that possible.
• Your bank credentials go directly to your bank through Plaid. Lasa never sees or stores them.
• The long-lived access tokens Plaid issues are stored encrypted in a secrets vault, readable only by Lasa's server functions. They are never sent to your browser, phone or Mac, and never logged.

Encryption

• All traffic uses TLS (HTTPS), with HTTP Strict Transport Security on lasa.money and app.lasa.money.
• Data is encrypted at rest by our database provider, Supabase, and stored in the United States.

Your account

• Sign-in is by a one-time link sent to your email, so there is no Lasa password to guess or reuse.
• Two-step sign-in with an authenticator app is available in Settings. Once it's on, the database itself refuses to return your data to any session that hasn't passed it, and deleting your account requires it.
• Every row of financial data is tied to your household and protected by row-level security in the database, so one household can never read another's data, even through a bug in the app.

The apps

• No ads, analytics, trackers or third-party scripts, except Plaid Link, which Plaid requires to load from its own servers while you connect an account.
• A strict Content Security Policy limits the app to Lasa's own code, its database and Plaid. Fonts and icons are served by Lasa, not third parties.
• The interface is written in-house with a deliberately small set of exactly pinned, regularly audited dependencies.

Your data, your control

• Disconnect any account at any time, which revokes Lasa's access through Plaid.
• Download all of your data from Settings → Your data.
• Delete your account, which revokes every connection and permanently deletes your data. See the Privacy Policy for details.

Reporting a vulnerability

If you believe you've found a security issue in Lasa, email security@lasa.money with the details and steps to reproduce. We'll acknowledge your report within 3 business days and keep you updated until it's resolved.

We won't pursue legal action for good-faith research that: only uses accounts you own; doesn't access, change or delete other people's data; doesn't degrade the service (no denial-of-service, spam or social engineering); and gives us reasonable time to fix the issue before you disclose it.