How we protect your data:
- No money, no payment credentials. SplitSol records who owes whom. It never moves money, so there are no bank logins or card numbers to steal.
- Encryption everywhere. All traffic uses TLS; all stored data is encrypted at rest on Google Cloud (Firebase).
- Deny-by-default access. Every record is unreadable unless a rule grants access; group data is visible only to that group’s members.
- Server-computed balances. Clients can never write balances or membership, so a tampered app can’t corrupt anyone’s ledger.
- Hashed contact discovery. Friend search uses salted hashes with your consent. Raw contact lists never reach our servers.
- Hardened sign-in. Short-lived one-time codes, server-side rate limiting, and app attestation (Firebase App Check).
- No ad or analytics SDKs. Crash reporting only, with no advertising identifiers.
Reporting a vulnerability
Found a security issue? Email security@splitsol.co with steps to reproduce. Please give us reasonable time to fix it before public disclosure and avoid accessing other users’ data. We credit researchers who report responsibly.