Security & Trust
Built to be trustedwith both your lives
recurrings.ai holds a map of your commitments — personal and business. That demands honesty about how it's protected: here is exactly what we do, and exactly what's still ahead.
No bank credentials, by design
The product never asks for a bank login. Statements you upload and emails you forward are the inputs — no bank network required, wherever your bank is.
Encryption in transit and at rest
All traffic is TLS-encrypted. Data lives in managed PostgreSQL with at-rest encryption, and high-sensitivity integration secrets get an extra layer: AES-256-GCM application-level encryption with authenticated, versioned ciphertext.
Workspace isolation
Every record is scoped to your workspace. Uploaded files are stored in a private bucket under workspace-scoped paths and served only through short-lived signed URLs — never public links.
Unguessable by default
Inbox addresses, invite links, and calendar feeds are all long random tokens. Invites expire. Nothing about your workspace is enumerable from outside.
Confirm-gated AI
Baaki proposes — you confirm — it applies. It cannot touch your data on its own, and applied changes are workspace-side: it stops tracking, recategorizes, drafts the cancellation — it never speaks to a vendor for you. Our AI provider (Anthropic) does not train models on API data, and our optional LLM observability records token counts and cost metadata, not your content.
Connections read what you grant
Gmail, Drive, Dropbox, and Slack connect over OAuth with scoped grants — the consent screen you approve is the whole of our access, nothing more. Revoke a connection anytime, from our settings or from theirs, and the grant dies with it.
We sell software, not your data
We use standard analytics and marketing-measurement tools — Google Analytics, Microsoft Clarity (which records session interactions to spot usability issues), and the Meta Pixel (which shares hashed identifiers like your email plus your IP with Meta to measure ads). We never send your uploaded statements, forwarded emails, or connected-inbox content to these tools, and we don't sell your personal information. The full cookie and data-sharing disclosure is in our privacy policy.
Your account, defended
Passkeys and two-factor codes for sign-in. Every active session listed in settings, and one button to sign out everywhere else when a device wanders off.
Your data is yours
Export everything with one click. And when you want out, close the account yourself — step-up verified, immediate, complete. Delete means delete: workspace, items, transactions, files, all of it.
Responsible disclosure
Found a vulnerability? Email security@recurrings.ai. We commit to acknowledging reports quickly and fixing verified issues with urgency — and we'll credit you if you'd like.
The shared map
What leaves your workspace
Recurrings keeps a shared registry of recurring-charge patterns, scrubbed of everything that's yours — your name, your account, your exact figure never travel. What joins the map is the merchant and its cadence, and only after three or more unrelated workspaces confirm the pattern; price data survives only as a k-anonymous median across that same floor. No customer's data ever appears on another's screen.
On your statement
On the shared map
Allied Insurance — renews monthly
Your name, your account, your amount never travel
What travels to the shared map is the merchant and its rhythm — never your name, your account, or your exact figure.
No badge theater
The roadmap, stated plainly
We only claim what's true. Here's where formal compliance stands — labeled honestly.
SOC 2 Type II
Formal audit planned as we move from private beta toward general availability.
Row-level security
Workspace isolation is enforced at the application layer on every query today; database-level RLS policies are being layered in as defense-in-depth.
GDPR & DPDP alignment
Export and deletion rights, minimal collection, and a public subprocessor list — the mechanics of data-protection law, built in from the start.
Questions about our security posture, or need a security review for your team? Write to security@recurrings.ai.
Continuity
The last security feature.
Safety check-ins ask, every so often, whether you're still there. If they go unanswered, the people you chose inherit exactly what you granted them — nothing more, nothing sooner. Most of this page is about keeping people out. This is the part that, one day, lets the right ones in.
Ready when something repeats
recurrings.ai is in private beta. Request access and we'll reach out as spots open up.