Security
Your data,
locked down
We ask for read-only access to your bank. Here's exactly what that means and how we protect it.
How connections work
Read-only,
by design
- Read-only bank access via Plaid — we never see your login credentials and cannot move money
- You can disconnect any time from your dashboard
- Data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
What we do with your data
Used to fund you. Nothing else.
Never
- Sold or rented
- Shared with marketers
- Shared with brokers or lead buyers
Only
- Underwrite your business and present offers
- Share with the lending partner whose offer you accept
Controls
How we run the platform
- SOC 2 Type II[PLACEHOLDER — confirm: in progress or complete]
- Penetration testingIndependent testing every year.
- Access controlRole-based access and MFA for all staff.
- MonitoringAutomated monitoring and alerting across systems.
- Data retention[PLACEHOLDER — confirm retention period after account close]
Report a vulnerability
Found something? Tell us.
Email security@tovah.com with details and steps to reproduce. We respond to every report.
Get funded today
Connect your accounts and see your real offers in minutes. Up to $5 million, funded the same day.