User-authorized connections
LifeOS only connects financial accounts after a user starts Plaid Link and consents to the connection. LifeOS does not move money or initiate payments.
Nutre Labs security
Security and data handling
Nutre Labs builds personal software that should be useful without becoming careless with sensitive data. This page summarizes current practices for Nutre Labs products, including LifeOS financial account connections, and names the hardening work still planned.
LifeOS financial data
LifeOS uses Plaid so a user can connect their own accounts and view personal financial context, such as balances, transactions, and recurring charges. LifeOS is not a bank, broker, lender, payment processor, credit product, or underwriting product.
Current practices
Backend-only Plaid credentials
Plaid client secrets, Plaid access tokens, and Supabase service-role credentials are handled by the backend. They are not embedded in the iOS app.
Encrypted Plaid access tokens
Plaid access tokens are encrypted before storage using application-level AES-256-GCM encryption. The encryption key is stored as a backend environment secret.
Protected transport
The iOS app, backend, Plaid, and Supabase communicate over HTTPS. Production services are intended to use TLS 1.2 or newer.
Scoped data use
LifeOS uses account and transaction data to show balances, recent transactions, recurring charges, and spending context. Financial data is not sold, used for advertising, or used for credit, lending, or underwriting decisions.
Row-level data boundaries
Finance tables are scoped by user ID and have row-level security policies. Backend service-role access is kept server-side.
Planned hardening
LifeOS is currently being prepared for personal testing and limited review. Before broader access, Nutre Labs plans to complete the following security and operations work.
- Replace personal testing credentials with production app authentication before broader access.
- Add an app-level authentication gate before Plaid Link is available to non-test users.
- Evaluate MFA for LifeOS accounts before opening financial account access beyond personal testing.
- Formalize written data retention and deletion procedures for LifeOS financial data.
- Add dependency and vulnerability scanning to the release process.
- Document an internal incident response and access review process for Nutre Labs systems.
Privacy and contact
Nutre Labs does not sell personal or financial data. Privacy questions, security questions, and data deletion requests can be sent to Nutre Labs.