Your money moves through us. It never sits with us.

There is no card entry form anywhere in The Contractor Codex. When your client pays, they pay on Stripe's own secure pages. The card goes from their browser to Stripe and never touches us.

• Stripe is certified at the highest level in the payments industry, PCI Level 1. We lean on their certification rather than handling cards ourselves.
• Money moves through Stripe Connect straight into your bank account. We never hold your client's funds.
• Refunds, late fees, and progress or milestone billing all run through the same path, so there is no back door where a card would be handled differently.

When you connect a bank account so Codex can sort your costs onto jobs, you sign in on Plaid's or Stripe's screen, not ours. We receive a read-only token for transactions and balances. It cannot move money.

• Your bank username and password are never sent to us and never stored by us.
• The connection is read-only. It can see transactions and balances, but it never gives us your account or routing numbers. It cannot move a dollar.
• The access token is encrypted before it is stored, and you can disconnect a bank at any time from your settings.
• To sort charges your rules cannot settle, Codex sends the charge's description, merchant, amount and date, with your job and client names, to the AI provider you chose. The morning Brief and the advisor also send charge summaries, including merchant names and amounts, to that provider.

Sign-in is handled by Clerk, a dedicated authentication provider, so passwords are never stored in our own database.

• Every account with admin access to a business must present a second factor. This is enforced by the app itself, not just recommended in a settings page.
• The check covers the admin screens and the actions behind them, including bank linking, Stripe linking, and financial exports.
• Client portal accounts are separated from admin accounts, and a client can only ever see their own projects, quotes, and invoices.

Traffic to the site is HTTPS only. Behind the scenes, the app talks to the database over an encrypted connection whose certificate is verified on every connect, so a stand-in server cannot quietly take its place.

• The database does not sit on the public internet. It lives on a separate machine with no public address and a firewall that only accepts the app.
• If the database certificate cannot be read, the database refuses to start rather than falling back to an unencrypted connection.
• Each business's data is kept separate, and calls an assistant key makes on your behalf are logged.

Backups run nightly and are encrypted before they ever leave the server. The key that decrypts them has never been on that server. It lives on encrypted drives held offline in two separate locations.

• Backups are copied offsite to storage that is write-only from the server's side, so someone who took over the machine could neither read the history nor destroy it.
• If encryption fails, the backup fails. It never quietly falls back to writing a readable copy.
• The restore path has been tested end to end from an encrypted backup, not just assumed to work, and restore drills are scheduled to repeat.

The admin screens, and the admin actions behind them, refuse any session that has not passed a second factor.

• Dependencies are checked automatically on every change for known high-severity issues.
• Errors are monitored so problems surface quickly instead of sitting unnoticed.