Security

How we protect your data and maintain the integrity of the service.

Our approach

Security is a core requirement of Ehfina, not an afterthought. We apply defense-in-depth principles across authentication, data storage, network transport, and operational practices.

Encryption in transit

All communication with Ehfina is encrypted using TLS (Transport Layer Security). Every connection to the Ehfina API, MCP endpoint, and authentication service uses HTTPS. We do not serve any content over unencrypted HTTP.

Encryption at rest

All data stored in Ehfina is encrypted at rest using industry-standard encryption provided by our cloud infrastructure (AWS). This includes database storage, backups, and any temporary processing data.

Authentication

Ehfina uses OAuth 2.0 for authentication, providing a secure, industry-standard authorization flow:

  • Short-lived access tokens — expire automatically, limiting the window of exposure if a token is compromised
  • Refresh tokens — used to obtain new access tokens without requiring re-authentication; can be revoked at any time
  • PKCE (Proof Key for Code Exchange) — prevents authorization code interception attacks
  • Token revocation — you can revoke any connected AI assistant's access immediately, which takes effect on the next request

Least-privilege access

Ehfina applies strict access controls:

  • Each user can only access their own data and data explicitly shared with them through consented sharing groups
  • AI assistant connections are scoped to specific operations and cannot widen access beyond what your account permits
  • Administrative functions are separated from user-facing operations
  • Internal infrastructure uses least-privilege IAM roles with no shared credentials

Credential and token handling

  • Passwords are hashed using industry-standard algorithms — we never store or transmit plain-text passwords
  • OAuth tokens are stored server-side and never exposed in client code or URLs

Data minimization

Ehfina collects only the data necessary to provide the service:

  • We do not collect browsing history, location tracking, or advertising-related data
  • MCP tool calls exchange only the specific data needed for each operation
  • Application logs are kept to a minimum and automatically expire after 14 days
  • We do not store your AI assistant conversations — only the specific data you or your assistant choose to share through individual tool calls

Access revocation

You can revoke access for any connected AI assistant at any time. Revocation takes effect immediately — the next request from a revoked assistant will be denied. See data controls for instructions.

Logging and monitoring

  • Operational logs record request metadata (request ID, route, status) without personal content
  • Security-relevant patterns are monitored, including authentication failure spikes and error rate anomalies
  • Alarms are configured to alert on potential security events
  • Incident response procedures are documented and tested

Vulnerability reporting

If you discover a security vulnerability in Ehfina, please report it responsibly:

  • Email: security@ehfina.com
  • Please do not disclose vulnerabilities publicly until we've had a chance to investigate and address them

What we do not claim

In the interest of transparency, we want to be clear about what Ehfina does not currently claim:

  • SOC 2 certification
  • ISO 27001 certification
  • HIPAA compliance
  • PCI compliance
  • Independent penetration testing
  • 24/7 security operations center

These may become relevant as Ehfina grows. We will update this page if and when any such certification or compliance is achieved.

Official MCP endpoint

The only official Ehfina MCP endpoint is:

https://api.ehfina.com/mcp

If you encounter Ehfina being served from any other URL, it is not official. Contact security@ehfina.com immediately.