Built to keep your ledger private

Factura holds something personal — a record of your household bills — so it's built to keep that record private by default. This page describes the measures in place and how to report a problem.

Because Factura is open source, these claims are verifiable: the authentication, authorization and storage code is all public. For how data is collected and used, see Privacy.

Sign-in is passwordless. Factura never stores a password, so there isn't one to leak. You sign in one of two ways:

• Google — standard OAuth; Factura never sees your Google password.
• Email code — a single-use six-digit code, valid for ten minutes, generated with a cryptographic random source and consumed on first use.

Sessions are server-side and tracked in the database, carried in an http-only cookie that JavaScript can't read. Signing in by email links to the same account as Google when the address matches, so you never end up with split data.

Every request is scoped to the signed-in user on the server. Access to a property is governed by a single source of truth — its membership list — and each API call re-checks it; nothing relies on the UI to hide data it shouldn't fetch.

The practical effect: you can only ever read or change bills, properties and vendors you own or have been explicitly invited to. An unfiled upload is visible only to the person who uploaded it.

Original PDFs live in S3-compatible object storage, encrypted at rest by the provider and stored under keys namespaced per account. The bucket is never public.

When you open a PDF, Factura mints a short-lived signed URL for that single file after checking you're allowed to see it — so access is always time-boxed and authorized, never a guessable public link. Deleting a bill deletes its stored object.

All traffic — the app, the API, transactional email links, and the signed storage URLs — is served over HTTPS/TLS. Bill text is extracted in your browser and sent over that encrypted connection for parsing and storage.

Secrets (database, storage and email credentials) are supplied through environment variables and are never committed to the repository. The database and object storage are managed services.

Factura is built on well-maintained, widely-audited open-source libraries, and dependencies are kept current to take in upstream security fixes.

Since sign-in flows through your email, the security of your inbox and your Google account is the front door to your ledger. Protect those — enable two-factor authentication on them — and sign out on shared devices.

Found a security issue? Please report it privately and give us a chance to fix it before any public disclosure. We welcome and appreciate good-faith reports.

• Email security@factura.uno, or open a private GitHub security advisory.
• Include steps to reproduce, the impact, and anything we need to confirm it.
• Please don't run tests that degrade the service, access other people's data, or exfiltrate data beyond what's needed to prove the issue.

We'll acknowledge your report, keep you posted on the fix, and credit you if you'd like.

No system is perfectly secure, and Factura is provided as open-source software without warranty. We aim for sensible, verifiable protections and continual improvement — and if you need full control, you can self-host the whole thing.