Data Security

Every business account is protected with an individually salted, industry-standard password hash. Google sign-in is delegated to Google's authenticated OAuth flow — we never see or store your Google password. Sessions are issued as short-lived signed tokens delivered over HTTPS-only, HttpOnly cookies.

All traffic between your browser and GoalsWalk is encrypted end-to-end using modern TLS. Internal service-to-service calls run on private networks. No plain-text credentials or files ever cross the wire.

Every database query is scoped by your unique user_id. You physically cannot see another business's uploads, analyses, follow-ups, or history. Attempts to fetch another user's report return a strict 404 — the system does not even confirm the resource exists.

Uploaded files are processed in-memory to extract the numbers your CFO needs and are then discarded. The resulting analysis (JSON + metadata) is stored against your account only, never in a shared bucket, never indexed for search, and never used to train third-party models.

Role-based access control (RBAC) is enforced on every administrative endpoint. Regular users cannot see or reach admin routes. Every admin action against a user account is logged with a timestamp for audit purposes.

We treat security as an ongoing practice, not a checkbox. Dependencies are patched routinely, the codebase is scanned for common weaknesses on every change, and the platform's controls are reviewed as it grows.

If you believe you have found a security issue, please email goalswalk@gmail.com. We will acknowledge within one business day.