Security is the product, not a footnote.
Fourth Meridian holds the most sensitive record most people own — the full shape of their money. We treat protecting it as a first-order feature. Here is what that means in practice, as the product is built today.
Your credentials are encrypted
Account passwords are hashed with bcrypt and never stored in plaintext. Bank connection tokens are encrypted at rest with AES-256-GCM, and the access they grant is read-only wherever the provider supports it.
Two-factor authentication
Protect your account with an authenticator-app second factor and single-use recovery codes. We nudge you toward enabling it and stay out of your way once you have.
Least-privilege access to your money
Bank and brokerage connections are read-only by design — Fourth Meridian can see balances, holdings and transactions to show them back to you. It cannot move funds, pay bills, trade, or change anything at your bank.
Every sensitive action is audited
Sign-ins, connection changes, exports, and account changes are recorded so there is always an honest trail of what happened to your account.
Rate-limited and abuse-resistant
Login, verification, password reset, and other sensitive endpoints are rate-limited to resist brute-force and automated abuse.
Your data, on your terms
Export a copy of your data from Settings whenever you like (up to three exports a day). Delete your account when you choose: deletion is scheduled with a seven-day window in which signing back in cancels it, and then your personal data is purged. We keep no more than we need to run the service.
Found something that looks wrong? Responsible disclosure is welcome — email us and mark it as a security report. support@fourthmeridian.com