Last updated 28 August 2026
Sign-in is handled entirely by Google. Finventory never sees or stores your password. Sessions use short-lived tokens that refresh automatically and are cleared when you sign out.
Every tank, reading and task row is tied to the account that created it. Row-level security rules are enforced by the database itself, so a request can only ever return rows belonging to the signed-in user — even if the client is tampered with.
All traffic is served over HTTPS. Data at rest is encrypted by our managed database provider, with automated backups.
Application code uses a publishable key with no elevated privileges. Administrative credentials are never exposed to the browser, and internal database routines are not callable by app users.
Parameter and fertiliser recommendations run on the server. The AI provider key never reaches the browser, requests are authenticated and scoped to your own tanks, and only the species and plant lists, water type and volume are sent. Recommendations are guidance only — verify them before acting on them.
If you believe you have found a vulnerability, please report it privately before disclosing it publicly. We aim to acknowledge reports promptly and fix confirmed issues as a priority.