Security

• Passwords are stored only as BCrypt hashes. An unknown email and a wrong password get the same answer.
• Five wrong passwords in a row lock the account for 15 minutes, whichever way you then try to sign in.
• Sign-in, sign-up and password-reset attempts are rate-limited per visitor, and reset emails per recipient.
• Google sign-in tokens are checked for Google's signature, the right application, expiry and a verified email before anyone is signed in.

• The access token lasts 15 minutes and is kept only in the page's memory.
• The session cookie is HttpOnly, Secure and SameSite, is replaced each time it is used, and a reused old copy ends the whole session. Signing out, changing or resetting your password ends sessions.

• Every business is walled off: every request is checked against the person's membership and role on the server.
• Team members see only what their role allows; customers in the portal see only their own records.
• Payments, invoices and expenses are voided with a reason, never deleted, and changes are recorded in the activity log.
• Recording the same payment twice by accident, for example after a dropped connection, is prevented on the server.
• Managio does not process payments and never stores card numbers.

• Pages and the API are served over HTTPS only, with a strict content security policy and other browser protections.
• Secrets live in the hosting providers' protected settings, never in the code.
• We check the libraries Managio is built on for known vulnerabilities and keep them updated.

If you think you have found a security problem, email nitinr0306@gmail.com with “Security” in the subject, the steps to reproduce it and what you think the impact is. Please:

• test only with accounts and businesses you created yourself;
• do not access, change or delete other people's data, and stop if you come across any;
• do not run tests that slow the service down for others, or send spam;
• give us a reasonable chance to fix the problem before telling anyone else.

We will confirm we received your report and keep you updated. There is no paid bug bounty. See also our Privacy Policy.