Security is the product, not a footnote.
Fourth Meridian holds the most sensitive record most people own — the full shape of their money. We treat protecting it as a first-order feature. Here is what that means in practice.
Your credentials are encrypted
Account passwords are hashed with bcrypt and never stored in plaintext. Provider access tokens are encrypted at rest, and read-only wherever the provider supports it.
Two-factor authentication
Protect your account with an authenticator-app second factor and single-use recovery codes. We nudge you toward enabling it and never get in your way once you have.
Least-privilege access to your money
Bank and brokerage connections are read-only by design — Fourth Meridian can see balances and holdings to show them back to you, and cannot move funds.
Every sensitive action is audited
Sign-ins, connection changes, exports, and account changes are recorded so there is always an honest trail of what happened to your account.
Rate-limited and abuse-resistant
Login, verification, and other sensitive endpoints are rate-limited to resist brute-force and automated abuse.
Your data, on your terms
Export a full copy of your data at any time, and delete your account when you choose. We keep no more than we need to run the service.
Found something that looks wrong? Responsible disclosure is welcome — reach us through the request-access form and mark it as a security report.