Prepared August 30, 2026 from the current My Legacy Console document at /security. Please use Microsoft Word Track Changes and comments for revisions./security

My Legacy Console is owned and operated by Montauk Trading Company, LLC, a Delaware limited liability company authorized to do business in New York. This document describes the security and compliance controls for the My Legacy Console service.

1. Security Architecture

Defense-in-depth approach to protecting your financial data

Client

HTTPS/TLS 1.3 Session Cookies CSP Headers Input Validation

↓

Auth Layer

OAuth 2.0 / Replit Auth Session Management RBAC (Owner/Admin/Member) Org Isolation

↓

API Layer

Route Guards Zod Validation Rate Limiting IDOR Prevention CORS Policy

↓

Data Layer

AES-256-GCM Encryption PostgreSQL Encrypted Volumes Automated Backups

↓

External

Stripe (PCI DSS) Plaid (SOC 2) OneDrive (Microsoft) OpenRouter / xAI

2. Encryption

Field-level encryption for sensitive financial data

AES-256-GCM Field-Level Encryption

Every sensitive financial field is individually encrypted before being written to the database. This means that even if the database is compromised, the data remains unreadable without the encryption keys. Each field uses a unique 96-bit Initialization Vector (IV), and the GCM mode provides both confidentiality and authenticated integrity verification.

🔒 What Gets Encrypted

Encryption Implementation Details

• Algorithm: AES-256-GCM (Advanced Encryption Standard, 256-bit key, Galois/Counter Mode)
• Key Length: 256 bits (32 bytes) derived from the encryption secret
• IV Generation: Cryptographically random 96-bit (12 byte) IV per encryption operation
• Authentication Tag: 128-bit GCM authentication tag appended to each ciphertext
• Key Storage: Encryption keys are stored as environment secrets, separate from the database
• Key Rotation: Supports key rotation without re-encrypting existing data (versioned keys)

3. Authentication & Authorization

Identity verification and access control

🔐 Authentication

• OAuth 2.0: Secure authentication via Replit identity provider
• Session Management: HTTP-only, secure, SameSite cookies with configurable expiration
• Token Validation: Every API request validates the session token server-side
• Auto-Expiry: Sessions automatically expire after periods of inactivity

👥 Authorization (RBAC)

Organization Isolation

Every database query is scoped to the authenticated user's organization (orgId). This ensures complete data isolation between organizations. Every API endpoint verifies that record.orgId === req.orgContext.orgId before returning or modifying data, preventing Insecure Direct Object Reference (IDOR) attacks.

4. Data Protection

Comprehensive data handling practices

Data Classification

Document Handling

Zero Document Storage

My Legacy Console operates on a link-only model for documents. All files remain in the user's Microsoft OneDrive account. We store only metadata (file names, IDs, and share links) in our database. This eliminates the risk of document exposure from our servers and gives users full control over their files.

• OCR Processing: Scanned documents are processed in memory for text extraction (Gemini Flash / xAI vision models) and immediately discarded — never written to disk
• Image Normalization: Uploaded images are converted to PNG via Sharp for consistent processing, then purged from memory
• OneDrive OAuth: Access tokens are securely managed and refreshed; revocable by the user at any time

5. API & Integration Security

Securing endpoints and third-party connections

API Security Measures

• Input Validation: All request bodies validated with Zod schemas before processing
• Authentication Required: Every API endpoint (except auth callbacks) requires valid session authentication
• IDOR Prevention: All data access verified against the user's organization context
• SQL Injection: Prevented by using Drizzle ORM with parameterized queries — no raw SQL
• XSS Prevention: React's built-in escaping + Content Security Policy headers
• CORS Policy: Configured to only accept requests from the application's own origin

☁️ Hosting & Infrastructure — Built on Replit and Google Cloud

• Enterprise-grade platform: My Legacy Console is hosted on Replit , a SOC 2 Type II–attested application platform, with production workloads running on Google Cloud Platform infrastructure (itself ISO 27001 and SOC 2 Type 2 compliant).
• Encryption everywhere: the platform encrypts data in transit with TLS and at rest with AES-256 server-side encryption — layered on top of our own AES-256-GCM field-level encryption described above, so sensitive fields are encrypted twice.
• Secrets isolation: encryption keys, API credentials, and database passwords live in the platform's managed secret store — never in source code, never in the database they protect.
• Isolated production environment: the published application runs in its own dedicated environment with its own database, separate from development.

How Bank Connections Work (Plaid) — Your Credentials Never Touch Our Servers

When you connect a bank account, you sign in through Plaid's own secure window — the same bank-connection service used by Venmo, American Express, and thousands of financial institutions. Your bank username, password, and any two-factor codes travel directly from you to Plaid to your bank; My Legacy Console never receives, transmits, or stores your bank login credentials at any point. What Plaid returns to us is a limited, read-only access token — it can retrieve the balances, transactions, and holdings you authorized, and nothing else. It cannot log in to your bank, initiate transfers, move money, or modify anything at your institution. That token is stored exclusively server-side, encrypted at rest with AES-256-GCM, and is never sent to your browser or device. When you disconnect an account, the token is deleted from our systems and revoked with Plaid; you may also revoke the connection independently through your bank's own security settings.

Third-Party Integration Security

6. Infrastructure

Hosting, deployment, and operational security

Hosting Environment

Platform Replit Cloud (US data centers)

Runtime Node.js (Express) + React (Vite)

Database PostgreSQL with encrypted storage volumes

SSL/TLS Automatic TLS 1.3 certificate provisioning

Backups Automated daily backups with point-in-time recovery

Secrets Environment secrets injected at runtime; never committed to code

7. AI & Model Security

Responsible AI usage and data handling

AI Data Flow

• Global Assistant (grok-3-mini-fast): Receives page-context summaries — never raw database records or PII
• AI Agent Cards (Gemini 2.0 Flash): Receive structured, page-specific context data for focused analysis
• OCR Processing (Gemini Flash / xAI Vision): Receives image data for text extraction; images processed in memory and immediately discarded
• No Training: Neither xAI nor OpenRouter/Google use your data to train their models
• Ephemeral: AI conversations are not persisted by the AI providers beyond the request lifecycle

PII Stripping

Before any data is sent to AI models, personally identifiable information (names, SSNs, account numbers) is stripped or replaced with generic placeholders. AI models receive only the contextual information necessary to generate useful responses.

8. Compliance Framework

Regulatory alignment and standards

9. Incident Response

How we handle security incidents

Incident Response Plan

Breach Notification

In the event of a data breach that affects your personal information, we will notify you by email within 72 hours of becoming aware of the breach, in compliance with GDPR and applicable US state breach notification laws. The notification will include the nature of the breach, data affected, remediation steps taken, and contact information for our security team.

10. Vulnerability Management

Proactive security testing and patching

• Dependency Scanning: Automated scanning of npm dependencies for known vulnerabilities (CVEs)
• Static Analysis: SAST tooling integrated into the development workflow to catch security issues before deployment
• Secret Detection: Automated scanning to prevent accidental exposure of API keys, tokens, and credentials in code
• Code Review: All changes undergo code review with security considerations
• Patch Management: Critical security patches applied within 24 hours; high-severity within 7 days

11. Business Continuity

Availability and disaster recovery

Recovery Objectives

Continuity Measures

• Database Backups: Daily automated backups with point-in-time recovery capability
• Code Version Control: All application code stored in version control with checkpoint history
• Document Resilience: Since documents are stored in users' OneDrive accounts, document data is inherently resilient to our infrastructure failures
• Graceful Degradation: If third-party services (Plaid, market data) are unavailable, the application continues to function with cached or locally stored data

12. Responsible Disclosure

Reporting security vulnerabilities

We welcome responsible disclosure of security vulnerabilities. If you discover a security issue, please report it to us so we can address it promptly.

How to Report

Email: security@mylegacyconsole.com

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Your contact information for follow-up
• We will acknowledge receipt within 24 hours
• We will provide an initial assessment within 72 hours
• We will not take legal action against researchers who report in good faith
• We ask that you do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them