Opulya
Back to signup

Security Information

Last updated: October 22, 2026

Personal financial information deserves careful protection. This page describes implemented application controls and their limits, not a security certification or a guarantee that incidents cannot occur.

Passwords are hashed using Argon2id rather than stored in plaintext. Only hashes of random session and verification tokens are stored. Authentication cookies are HttpOnly and use Secure in production; sessions expire and logout revokes them. The API checks ownership, validates input, applies request and email-abuse limits and rejects untrusted mutation origins. Financial operations use precise decimals and database transactions. Production HTTPS is required by the app configuration.

Use a unique password or passphrase, protect the email account that receives verification links, and log out on shared devices. Never share passwords, session cookies or verification links. Opulya does not need access to your bank, broker or crypto-exchange login. Avoid entering those credentials in any field.

Data is not end-to-end encrypted: authorized service operators and infrastructure providers can technically access stored information. MFA, passkeys and self-service password recovery are not implemented. Security also depends on deployment configuration, provider controls, timely patching, access management, backups and incident handling. No independent penetration test or formal OWASP certification is claimed. Do not use Opulya as your only copy of important financial records.

Contact the operator using the privacy and security address in the Privacy Notice. Share the affected page, approximate time and a minimal reproduction, without passwords, tokens or other users' financial data. Do not access other people's accounts or perform disruptive testing. Reports do not authorize testing against hosting or other third-party services. The operator is responsible for investigating incidents and any notifications required by applicable law.

These notices do not certify compliance with GDPR or every privacy law. Your statutory privacy and consumer rights are not waived by registration or use of Opulya.