A boundary against money movement.

When you connect a financial account through Plaid, Voyager will explicitly request read-only OAuth scopes. Our ingestion adapters are designed to discard any write, payment, or modification capabilities granted during token exchange. There will be no background jobs, administrative controls, or automated routines capable of initiating transactions, bill payments, wire transfers, or securities orders. Your assets remain anchored in your financial institutions. Because the planned backend will lack fund-movement software interfaces, even an authorized system administrator or compromised service credential could not initiate financial transfers. We believe financial visibility should never create operational vulnerability across connected banks, credit cards, and brokerage portfolios.

Every build is planned to run automated isolation-verification scripts performing static analysis on frontend bundles, Docker containers, and API manifests. The goal is to ensure no internal financial schemas, database credentials, or provider secrets ship in client-facing artifacts. Boundary definitions are treated as immutable invariants so architecture diagrams match the running production system once live.

Provider credentials and institution access tokens are designed to never touch client browsers, public marketing containers, or persistent log streams. Ingestion workers are planned to run in an isolated backend subnet with zero direct inbound internet access. Tokens would be decrypted only transiently in memory by dedicated workers during scheduled sync runs, using keys rotated automatically via a hardware security module. Database connections will use mutual TLS with strict certificate verification. Raw provider secrets and bank account numbers will never be stored unencrypted, and inter-service traffic inside the virtual network will be authenticated and encrypted.

The public marketing site, web client, and backend API run in segregated runtime environments. The marketing app has no network route or database credentials to customer finance APIs. Client requests require cryptographically verified JWTs signed by Supabase Auth. PostgreSQL Row-Level Security policies under private-preview evaluation restrict every query to the verified tenant identifier, limiting cross-tenant leakage even if an application-layer defect occurs. Automated dependency scans and static analysis run before any build is promoted to staging or production.