This Security and Responsible Disclosure Policy (this "Policy") describes the technical and organizational measures that Renvie ("we", "us" or "our") maintains to protect data processed through the Renvie websites, applications and related services, including Renvie AI (collectively, the "Service"), and sets forth the terms under which security researchers may report vulnerabilities. Capitalized terms used but not defined in this Policy have the meanings given to them in the Renvie Terms of Service or the Renvie Privacy Policy.
1. Security Measures
As of the date of this Policy, Renvie maintains the following measures:
1.1 Encryption. All requests to the Service, from both the websites and the iPhone application, are transmitted over HTTPS. Data at rest is encrypted by our hosting provider.
1.2 Account Isolation. Each account is technically restricted to its own records. This restriction is enforced within the database itself and not solely within the application.
1.3 Authentication. Users who authenticate through Sign in with Google are subject to the two-step verification settings of their Google account. Passwords are stored only in scrambled (hashed) form, and we check new passwords against known leaked passwords. The Service requires re-authentication before account deletion, data restoration and other sensitive actions where the most recent sign-in is not sufficiently recent.
1.4 Bank Statement Files. Renvie does not request bank login credentials and does not connect to any financial institution. When the Service processes a bank statement file, it retains only the last four (4) digits of the account number and truncates long numeric sequences in transaction descriptions. A PDF statement is processed on the user's device and is not retained.
1.5 Renvie AI and Web Lookups. Renvie AI transmits to its providers only the information required to respond to a given question. Web lookups transmit only short public search terms; names, addresses, unit labels, tenant names and amounts drawn from user records are blocked from transmission. Users may disable Renvie AI in Settings, in which case the server declines new Renvie AI requests.
1.6 Usage Limits. Uploads are limited to fifty (50) megabytes per file (ten (10) megabytes per receipt photograph, in JPEG, PNG, HEIC or PDF format only), and Renvie AI questions are subject to a daily limit.
1.7 Personnel Access. Access by Renvie personnel is limited to that reasonably necessary to operate and support the Service, and actions taken through our administrative tools are recorded in an audit log.
1.8 User Controls. Users may at any time delete their data, delete all Renvie AI data or delete their entire account through Settings.
2. No Guarantee of Security
NO METHOD OF TRANSMISSION OVER THE INTERNET AND NO METHOD OF ELECTRONIC STORAGE IS COMPLETELY SECURE. ALTHOUGH RENVIE MAINTAINS THE MEASURES DESCRIBED IN THIS POLICY, RENVIE DOES NOT REPRESENT, WARRANT OR GUARANTEE THAT THE SERVICE OR ANY DATA WILL BE FREE FROM UNAUTHORIZED ACCESS, LOSS OR DISCLOSURE. In the event of a security incident affecting your personal information, Renvie will notify you and the competent authorities as and when required by applicable law.
3. Responsible Disclosure
3.1 Reporting. If you believe you have identified a security vulnerability in the Service, please report it through Help and Contact, or by email to legal@renvie.app, including a description of the vulnerability and the steps necessary to reproduce it.
3.2 Conditions. In conducting any security research relating to the Service, you agree to the following conditions:
(a) you shall afford Renvie a reasonable period to remediate the vulnerability before disclosing it to any third party;
(b) you shall use only your own account and test data, and shall not access, modify or delete the data of any other user;
(c) you shall not degrade or disrupt the Service, and if you encounter data that does not belong to you, you shall cease testing immediately and notify Renvie;
(d) you shall not conduct denial-of-service testing, send unsolicited messages, or engage in social engineering or physical attacks; and
(e) you shall comply with all applicable laws.
3.3 Safe Harbor. Provided that you comply in good faith with Section 3.2, Renvie will not initiate legal action against you in connection with your research, and will notify you when the reported vulnerability has been remediated. This safe harbor applies only to claims within Renvie's control and does not bind any third party.
3.4 No Bounty. Renvie does not currently operate a paid bug bounty program, and no report shall entitle the reporting party to any payment or other compensation.
4. Amendments
Renvie may amend this Policy from time to time. The date at the top of this Policy indicates the date of the most recent revision.