Trust center
Security and control
Sclerite Home Audit separates financial truth from AI interpretation and keeps every provider-dependent request fail-closed when its production configuration cannot be verified.
Effective September 5, 2026
Implemented safeguards
- ChatGPT sign-in with server-side household ownership checks on protected reads and writes.
- Explicit versioned consent before checkout or financial connection.
- Application-level AES-256-GCM encryption for Plaid access tokens, financial snapshots, generated reports, and monitoring events.
- Signed Plaid and Stripe webhook verification, bounded payloads, duplicate-event handling, same-origin checks, and request rate limits.
- Customer export, individual institution disconnection, complete deletion, and minimal deletion receipts.
- Deterministic ledger arithmetic with integrity tests; AI may only explain verified recommendation IDs, and its output is rejected if it introduces numeric claims.
- HTTPS, HSTS, restrictive content security and browser permissions, anti-framing, and no-store responses for private APIs.
Live operations
- Plaid Production credentials and signed webhook verification are active; connection failures do not create usable customer records.
- Stripe checkout verifies the live $72 audit and $13 monthly monitoring catalog before starting a payment, then grants access only after a signed paid event.
- The optional OpenAI explanation layer remains disabled until an approved production key and live output-verification test are complete; deterministic recommendations remain available.
- Encryption-key rotation, recovery testing, alert validation, and independent security and legal review remain ongoing operational responsibilities.
Provider boundaries
Sclerite never asks for or stores an online-banking password; customers authenticate inside Plaid Link. Payment-card details are collected by Stripe-hosted Checkout and do not enter Sclerite systems. Provider credentials are server-only and are never included in browser code or source control.
Incident readiness
The release runbook requires immediate capability containment, credential rotation, minimal evidence preservation, customer-impact assessment, notification review, verified recovery, and a documented corrective plan before reopening.
Data boundary
Home Audit data may never be reused by Sclerite Intelligence or another Sclerite product. Cross-product credentials, databases, analytics identities, and administrator access are prohibited.
Report a concern
Email support@scleritehomeaudit.com with the subject “Security concern.” Include the affected page, approximate time, and a plain-language description, but no credentials or sensitive financial data.