DayCents

Security

The most secure data is the data we never collect. Our architecture starts there.

Your financial inputs never leave your browser

Every calculator on DayCents computes locally, in your browser. The amounts, rates, and balances you type are not transmitted to our servers, not logged, and not stored. There is no account system and no profile being built — close the tab and the numbers are gone.

Transport & platform security

  • All traffic is served over HTTPS with HTTP Strict Transport Security (HSTS) enforced.
  • Hardened response headers: Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and frame-ancestors protection against clickjacking.
  • Infrastructure runs on Vercel (hosting/CDN) and Supabase (managed Postgres for editorial content and newsletter subscriptions), both SOC 2-audited platforms. Secrets are stored in environment configuration, never in the codebase.
  • The one dataset we do hold — newsletter email addresses — is stored with spam-resistant validation and used solely to send the newsletter. See the privacy policy.

No payment data

DayCents is free and processes no payments today, so we hold no card numbers or bank credentials of any kind. If we ever introduce paid features, payments will be handled by a PCI DSS-compliant processor and card data will never touch our servers.

Engineering practices

  • The calculation engine is covered by 150+ automated golden and property-based tests verified against authoritative references, run on every change before deploy.
  • Continuous integration gates every release: type checks, linting, tests, build.
  • Dependencies are version-locked and the deployment pipeline is access-controlled.

Responsible disclosure

If you believe you've found a vulnerability, please email security@daycents.com with steps to reproduce. We commit to acknowledging reports within 2 business days, keeping you informed as we investigate, and crediting you (if you wish) once a fix ships. We ask that you avoid accessing other users' data, degrading the service, or publicly disclosing before a fix is deployed. Good-faith research conducted under these guidelines will not be met with legal action.