Security

Vague claims like bank-level security tell you nothing. Here is specifically what we do, stated precisely enough that you could call us out if it were not true.

What we never collect

• Your bank login. There is no bank-linking anywhere in Subnope, no Plaid, no screen-scraping, no account numbers. We cannot leak credentials we never hold.
• Card numbers for tracked subscriptions. You tell us what you pay; we never touch how you pay it. Your Subnope Pro payment is processed by Stripe and the card never touches our servers.

Encryption, specifically

• At rest: your most sensitive fields, legacy letters and credential hints, are encrypted with AES-256-GCM before they reach the database. A database breach alone cannot read them.
• Key separation: the encryption key is never stored in the database. Losing it would make vault data permanently unreadable by anyone, including us. That is deliberate.
• In transit: TLS everywhere, with HTTP Strict Transport Security so browsers refuse unencrypted connections.
• Passwords: hashed with bcrypt. We never store, see, or transmit your password in plain text.

Account protection

• Two-factor authentication via TOTP authenticator apps is available free on every account.
• Hardened HTTP headers throughout: strict Content-Security-Policy, frame-embedding denied to prevent clickjacking, MIME-sniffing disabled.

How the dead-man switch actually works

Your vault watches for activity: any sign-in resets the clock. If you go quiet, we email you escalating check-ins as the deadline nears — 30, 14, 7, 3, and 1 day before your inactivity window closes — each with a one-tap “I’m still here” link that needs no sign-in. In the last week we also ask your confirmed guardian to reach you before anything fires. Only after the full window passes with no response does the vault hand over to your confirmed guardian. If it fires by mistake, signing in automatically un-triggers it — every claim link dies and every guardian session is revoked. Nothing is ever shared with a guardian who has not verified their email.

Your data is yours

• Export your subscriptions as CSV or your vault as a printable report at any time from Settings.
• Delete your account and all data permanently, yourself, with no email to support and no retention games.
• We do not sell data. There are no ads. You are the customer, not the product.

Found a vulnerability?

Email support@subnope.com with details. Good-faith security research is welcome. We will respond quickly, fix fast, and credit you if you would like.

Last updated July 2026. When our security posture changes, this page changes. See the changelog.