Security

At a glance

Protecting your money

• We only debit the amounts and dates shown when you confirmed a bill, plus your membership.
• Payments to billers go only to billers our team has verified, and large payouts need approval from two different people.
• Unauthorized debit claims and bank disputes place an automatic hold on the account while we review them.
• You get an email or text for every payment, so nothing happens without you knowing.

Protecting your information

• Uploaded documents are stored privately, encrypted, and opened only through short-lived links by authorized staff.
• Sensitive details such as insurance policy numbers are masked in the app.
• Our servers run in private networks behind a web application firewall with rate limiting.
• We never sell your personal information.

Inside AutoFloat

• Staff sign in with multi-factor authentication and can only access what their role requires.
• Every verification, payment and account change is recorded in a permanent audit log.
• Automated monitoring alerts our team to errors, unusual activity and service outages around the clock.
• Databases are backed up automatically and restore is tested.

Keeping your account safe

• Turn on two-step sign-in in Settings.
• Use a unique password you don't use anywhere else.
• AutoFloat will never ask for your password, a sign-in code or your full bank account number by email, text or phone.
• Watch for emails that only look like ours. Our messages come from autofloat.co.

Report a vulnerability

If you believe you've found a security issue, email security@autofloat.co with the details and steps to reproduce it. We'll acknowledge your report, keep you updated and credit you if you'd like. Please give us a reasonable time to fix it before sharing it publicly, and don't access other members' data or disrupt the service while testing.