Security and data

Duesback handles financial data, so this page says plainly what we receive, what we keep, and what we never touch. The privacy policy is the binding version.

What we never see

• Bank logins. The bank connection belongs to Muse (through Plaid). Duesback has no credentials to any bank and no way to move money.
• Account numbers, card numbers, names or addresses. We do not ask for them and Muse does not send them.
• Anything you did not approve. Muse asks before it shares information with duesback.com, and shows what it shares.

What we receive and what we keep

When you ask for an audit, Muse sends recent transactions. We process them in memory to find recurring charges and fees, and then discard them. Raw transactions are never written to a database, a log or a backup.

What we keep is the minimum needed to re-audit and to verify outcomes: recurring-charge signatures (merchant, cadence, typical amount, first and last dates), the findings we gave you, the outcomes Muse reported with their evidence, and fee records. Full detail and retention periods are in the privacy policy.

Sign-in

• OAuth 2.1 with PKCE, dynamic client registration and a device flow for agents that cannot open a browser. One scope.
• Access tokens are short-lived; refresh tokens rotate, and a replayed refresh token revokes the whole family.
• Tokens and API keys are stored only as salted hashes. Disconnecting revokes every token and key at once.
• Sign-in pages and registration endpoints are rate-limited per address and per email.

Payments

Fees are paid through Stripe Checkout. Card details go to Stripe, never to us. Each fee is a separate payment the user approves; nothing is charged automatically unless the user turns on autopay, and that can be turned off in one message. Stripe webhooks are signature-verified before anything is recorded.

Infrastructure

Everything on this domain runs on Cloudflare: Workers for the application, D1 for storage, Email Routing and static assets. Traffic is TLS only. Secrets live in Workers secrets, never in code or in the repository. Transactional email goes through Resend with SPF, DKIM and DMARC configured for the domain. Merchant classification sends merchant text and amounts, nothing else, to a language model through OpenRouter.

Deletion

Say "Duesback, disconnect" to Muse, or email us. Signatures, findings, outcomes and credentials are deleted within 30 days, sooner on request. Fee records and receipts are kept for up to 7 years for tax and accounting, as the privacy policy describes.

Reporting a vulnerability

Email hello@duesback.com with the details. We reply within two business days, and we will not pursue anyone who reports in good faith. A machine-readable contact is published at /.well-known/security.txt.

We do not run a paid bug bounty program. Reports that lead to a change are credited here with the reporter's permission.

If a breach ever affects your data, we will email you without undue delay after confirming it and tell you what happened and what we did.