Security

Pyrse can never move your money. Its connections to your bank (Plaid) and register (Square) request read-only access only — no product, permission, or scope that could transfer, pay, or refund is ever requested. There is no "send money" button, because there's no code path that could move money.

Everything you send or receive is encrypted in transit (HTTPS). Your data is encrypted at rest on our database provider.

The access tokens that let Pyrse read your bank and register are encrypted with AES-256-GCM before storage, using a key held only on our servers. Those tokens never appear in your browser, never in URLs, and never in logs.

Your business's numbers are visible only to you and the people you add to your business. Isolation is enforced at the database layer — row-level security on every table — so a query from one business can never return another business's rows, even if application code were to slip.

Only the people running Pyrse have access to the systems holding your data, and only to keep the service running. We log identifiers and counts (like "a sync failed") — never amounts, merchant names, or account numbers.

Webhook callbacks from Plaid and Square are verified by cryptographic signature before anything is acted on, and unverifiable requests are discarded.

Pyrse does not store credit card numbers, and it has no capability to charge you or anyone else.

Use a strong, unique password for your Pyrse account.

Disconnect a bank account or register any time in Settings — disconnecting removes that connection's access.

If you ever see something in your dashboard that shouldn't be there, tell us immediately at vaughn@mypyrse.com.