Viably
PrivacySecurityMethodologyTry it

Trust Center

Every trust question in one place.

Live status, security posture, privacy commitments, subprocessors, retention windows, and the latest release — all on this page. The numbers below are drawn from the same production telemetry we monitor in real time.

Live status

Refreshes every 30s

Checking…

checking…

Read p95

—ms

Read p99

—ms

Error rate

—%

Methodology: Read latency is approximated from the production Bounded recent request sample across all endpoints. Error rate is 5xx ÷ total over the last five minutes; no sample is reported as unknown. For the underlying machine-readable feed, hit /api/observability/public-status.

The three policies

Three plain-language documents — each its own deep dive, all kept current.

Privacy

Plain-language commitments, named subprocessors, no tracking pixels.

Read the policy

Security

HTTPS-only, bcrypt, TOTP/passkeys, every retention window enforced by a test.

Read the posture

Methodology

Every formula and data source for the viability score, citations included.

Read the math

Number provenance

The dashboard answer now carries its own math trail.

Safe-to-spend is not just a number. In the app, the first dashboard card exposes the live inputs, formula, timing adjustment, and a direct methodology link so users can check why Viably thinks the week is safe or short.

Formula

Cash + next paycheck − upcoming bills

Inputs

Timestamps and live dashboard payload values

Source

Methodology page and public data registry

What we commit to

Each row maps to a live test in the codebase. If one of these slips, CI fails before the change ships.

  • Audit logs retained 365 days, then auto-deleted by the retention cleanup contract.
  • Marketing-funnel analytics retained 90 days and contain zero PII (anonymous visitor IDs only).
  • Account deletion is a transactional cascade — every personal record removed in seconds.
  • No third-party tracking pixels. Verify in any devtools Network tab.
  • Bcrypt password hashing (12 rounds), optional TOTP and WebAuthn passkeys.
  • HTTPS-only with HSTS preload; HttpOnly, Secure auth cookies on supported app domains.
  • Per-device session list visible to every user — revoke any session, anytime.

Service providers and subprocessors

Named services with narrow roles. Optional and deployment-configured services remain visible here even when a particular environment has them disabled.

Stripe

Payment processing only.

Resend

Transactional email delivery.

Google OAuth (optional)

Optional sign-in, only when you choose Google.

Cloudflare

CDN, request transit, and DDoS protection when used by the deployment.

Plaid (optional)

Optional, user-initiated bank connection and balance sync.

Sentry (when configured)

Error and sampled performance monitoring when a Sentry DSN is configured.

Emergent LLM gateway (when configured)

Optional AI processing for OCR, Scenario Lab, and changelog summaries when an Emergent key is configured.

Google AI / Gemini (when configured)

Optional direct AI processing for OCR and Scenario Lab when a Gemini key is configured.

Groq (when configured)

Optional direct AI processing for Scenario Lab when a Groq key is configured.

Railway (when used for hosting)

Application, database, cache, and network hosting for Railway deployments.

Amazon S3 (when selected)

Optional S3-compatible object storage for uploaded documents and generated exports.

Cloudflare R2 (when selected)

Optional S3-compatible object storage for uploaded documents and generated exports.

Google Cloud Storage (when selected)

Optional S3-compatible object storage for uploaded documents and generated exports.

Firebase Cloud Messaging (when configured)

Optional native push delivery for Android and iOS through Firebase Cloud Messaging. On iOS, Firebase routes delivery through Apple Push Notification service (APNs).

Apple (when mobile billing or iOS push is configured)

Optional App Store purchase-receipt verification and APNs transport for iOS notifications routed through Firebase Cloud Messaging. Viably does not currently operate a direct APNs client.

Google Play (when mobile billing is configured)

Optional Google Play purchase-token verification.

Browser or OS push service (when enabled)

Optional standards-based notification delivery through the service selected by your browser or operating system.

Honest disclaimers

  • · We are not yet SOC 2 Type II certified. We design for the controls but the audit is on the roadmap.
  • · We are not a HIPAA business associate. Don't upload Protected Health Information.
  • · No paid bug-bounty program yet. Disclose to security@viably.tech — we credit publicly at your discretion.

Trust, then verify

The trust commitments are real.
The product is too.

Run your audit

Free. No credit card. Account creation requires only an email.