Security & Trust

Your loan book is safer here than it ever was in a spreadsheet.

Moving off Excel can feel like trusting your whole business to a black box. So here is exactly how Capital Pilot protects your money, your records, and your peace of mind — in plain English, with nothing left vague. Money is undone, never deleted. A complete encrypted copy of your book is saved off-site every day and checked overnight. And every number is checked to the penny.

The three things that keep you up at night

You have run your book by hand for years. Here is the honest answer to the fears that come with switching.

“Will it break and lose my data?”

No. Deleting a payment is reversible — the original is kept, never erased. Every change is logged with its old value. And a complete encrypted copy of your whole book is saved off-site and checked every day.

“Will the servers go down and leave me stuck?”

Capital Pilot runs on a professionally managed database with a live health check that automatically restarts the service if it ever stops responding. If an update goes wrong, the previous working version keeps running. It keeps watch and restarts itself automatically.

“Will everything just erase one day?”

No. Money is undone, never deleted. The financial ledger and activity log are append-only and survive deleting a customer or loan. And with a daily off-site encrypted backup, a crash can cost at most a day’s entries — never your whole book.

How your book is protected

Seven promises we keep — starting with the two that matter most: your data is never lost, and your data is always yours.

Never lost

Your data is never lost, and never erased

Money is undone, never deleted, and your whole book is copied off-site and checked every day.

Deleting a payment is a reversible soft-reversal: the original row stays with a timestamp and a compensating ledger entry, so money is undone — never erased — and the full original details stay on record.
A complete encrypted copy of your database is saved off-site automatically every day, with zero work from you.
Every backup is fingerprinted with SHA-256 and, that same night, re-opened and decrypted as an automatic integrity check — so an obviously corrupt backup is caught right away, not on disaster day.
Off-site copies are kept in your own separate Dropbox, so even if the app server died, your data is safe somewhere else entirely.
If a daily backup ever fails, the system records it and emails an alert, so a missed backup never goes unnoticed.
A written, scripted recovery procedure restores your data from the latest daily copy.

Always yours

Your data is yours, with no lock-in

Download your whole book — payments, customers, and loans — as a spreadsheet any time, and bring your existing Excel book in when you start.

Export your full payment history as a standard CSV that opens in Excel, Google Sheets, or hands straight to your accountant — with columns for date, customer, loan, amount, method, type, week, and note.
Export your customer list and your loan terms to CSV too — your whole book, not just payments — so you are never holding your business inside one company’s walls.
Pull just one month, one quarter, or your whole history using a date range.
Coming off Excel is supported: your current customers, loans, and historical payments come in from your existing spreadsheet, so you do not start from a blank screen.
Re-importing the same spreadsheet never double-counts a payment, because every row is fingerprinted on import.
Only the owner can export the book, and every export is recorded in the activity log.

Always exact

Your numbers are always exactly right

Exact penny math, no accidental double-charges, and a nightly self-check that emails you if anything ever disagrees by a cent.

Balances are calculated with exact penny arithmetic (Python Decimal), so totals never drift by a fraction of a cent the way a spreadsheet quietly can.
If a collector double-taps Pay or the network retries, the payment is recorded once and only once — enforced by a unique database index — so no accidental double-charges.
You can never record more than a loan owes: the system refuses the overpayment and records nothing, so no phantom credits or negative balances.
Behind every balance is an append-only ledger of each dollar in and out, written in the same transaction as the payment, so the book always traces back to source events.
Every night the system recomputes each loan’s balance and compares it to the ledger; if they ever disagree by even a penny, you get an email, so you are never the last to know.
Even deleting a customer or loan cannot wipe the record of money that moved, because the ledger is append-only with no cascade delete.

Right people only

Only the right people get in, and only to what they should see

Strong password hashing, brute-force lockout, role-based access, and instant cutoff of a fired employee.

Passwords are stored only as a one-way bcrypt hash, never as readable text — not even to us.
Repeated wrong-password guessing is automatically slowed and then locked out, with limits that cannot be dodged by changing the username’s capitalization.
Failed logins never reveal whether the username was real, defeating attackers who try to fish for valid accounts.
Staff get only the access their role allows: a collector cannot delete loans or reach owner-only settings, and can only see the borrowers you assign to them.
The moment you deactivate a fired employee, they lose access on their very next click, because every request re-checks their account — not just their login.
Your admin session is signed so it can’t be tampered with, is hidden from page scripts, is sent only over a secure (HTTPS) connection, and automatically signs out after 8 hours.
The app refuses to start in production without a real secret key, so nobody can forge a login.

Always recorded

Every change is recorded, and the record can’t be quietly rewritten

A permanent, searchable activity log captures who did what, from where, and when — including the old value before every edit.

For every important action, the system permanently records who did it, from what network, exactly what they did, and the precise time.
Activity records are only ever added inside the app, never edited or erased, so the history cannot be quietly rewritten.
Every sign-in, wrong-password attempt, and lockout is recorded, so you can spot someone trying to break in.
If someone changes a payment, the log keeps both the old and new values; if someone deletes a payment, the full original details are kept for disputes.
The owner gets a searchable, filterable activity log in plain English, and each borrower’s page shows their recent account history.
Record-keeping runs separately from the action itself, so logging can never break or roll back recording a payment or loan.

Stays up

The app stays up, watches itself, and recovers on its own

A professionally managed database, a live health check, and automatic restart if anything stops responding.

Your data lives in a professionally managed PostgreSQL database server — the same kind of database large web apps run on — not a single file on one disk.
A health endpoint constantly checks that the database is actually responding and reports a failure immediately instead of leaving you on a broken screen.
If the app crashes or stops responding, the hosting platform automatically restarts it, up to several retries, with no phone call required.
Updates apply safely: if anything about an update goes wrong, the previous working version keeps running instead of taking you offline.
When something breaks, the team gets an automatic alert with the details, and that alerting is configured to never send your customers’ personal information.
The app runs on a production-grade web server built to handle multiple people at once, with all traffic encrypted over HTTPS.

Hardened

The app is hardened against common web attacks

Injection-safe queries, cross-site request protection, and browser-level guardrails on every page.

Customer and payment data is queried using parameterized statements, blocking SQL injection — the most common kind of database break-in.
A malicious website cannot trick your browser into silently recording a payment or changing a loan: every action requires a secret token only your real pages carry.
Customer names and notes are shown as plain text, not run as code, protecting against cross-site scripting.
Browser-level guardrails on every page — Content-Security-Policy with a fresh per-request key, clickjacking and frame blocking, and a 1-year HTTPS lock — make injected or impersonating code much harder to run.
The app refuses abnormally large uploads, so it cannot be knocked over by giant requests.
Login pages cannot be abused to bounce you to a fake lookalike site after you sign in.

How we protect your data

For the careful evaluator — the specifics, grouped and plain.

Encryption & access Access

Passwords are stored only as a one-way bcrypt hash — never as readable text, not even to us.
Brute-force guessing is slowed then locked out, and the limit cannot be dodged by changing the username’s capitalization.
Failed logins never reveal whether a username is real.
Role-based access: a collector cannot delete loans or open owner-only settings, and sees only the borrowers you assign.
Deactivating a fired employee cuts their access on their very next click, because every request re-checks the account.
Your admin session is signed so it can’t be tampered with, is unreadable by page scripts, is sent only over a secure connection, and signs out after 8 hours.
The off-site backup file is protected with authenticated AES-128 encryption.

Backups & recovery Recovery

A complete encrypted copy of the database is saved off-site automatically every day.
Each backup is fingerprinted with SHA-256, then re-opened and decrypted that same night as an automatic integrity check.
Off-site copies live in your own separate Dropbox, away from the app server.
A failed backup is recorded and triggers an email alert, so a miss never goes unnoticed.
A written, scripted recovery procedure restores from the latest daily copy.

Money accuracy Exact

Balances use exact penny arithmetic (Python Decimal) — no quiet fraction-of-a-cent drift.
A unique database index records each payment once and only once, even on a double-tap or network retry.
Overpayments are refused outright — nothing is recorded — so no phantom credits or negative balances.
An append-only ledger records each dollar in and out, written in the same transaction as the payment.
A nightly self-check recomputes every balance against the ledger and emails you on any penny-level disagreement.
Deleting a customer or loan cannot erase the record of money that moved.

Privacy & the record Audit

Every important action records who did it, from what network, what they did, and exactly when.
Activity records are only added inside the app — never edited or erased — so history can’t be quietly rewritten.
Every sign-in, wrong-password attempt, and lockout is recorded.
Edits keep both old and new values; deletions keep the full original details for disputes.
The owner gets a searchable, filterable activity log in plain English.
Error alerting to the team is configured to never include your customers’ personal information.

Reliability Uptime

Your data lives in a professionally managed PostgreSQL database — not a single file on one disk.
A health endpoint constantly confirms the database is responding and reports failures immediately.
If the app stops responding, the hosting platform restarts it automatically, up to several retries.
If an update goes wrong, the previous working version keeps running instead of taking you offline.
It runs on a production-grade web server built for multiple people at once, with all traffic over HTTPS.

Web-attack hardening Defense

Parameterized statements block SQL injection.
Every state-changing action requires a secret token only your real pages carry (CSRF protection).
Customer names and notes render as plain text, not code, defending against cross-site scripting.
Content-Security-Policy with a fresh per-request key, frame/clickjacking blocking, and a 1-year HTTPS lock on every page.
Abnormally large uploads are refused so the app can’t be flooded over.
Sign-in cannot be abused to bounce you to a fake lookalike site afterward.

On our roadmap — not yet shipped

What we’re building next

We believe a trust page should be honest about what is here today and what is still ahead. These are protections we are working toward — they are not live yet, and nothing above depends on them.

We’re working toward optional two-factor sign-in (2FA)

Today, login is a single strong password with brute-force lockout. An optional second step would further protect owner and staff accounts if a password is ever phished.

We’re working toward an independent security review

We follow strong security practices, but the app has not yet been independently audited or certified. A formal third-party path (such as SOC 2) and an outside penetration test would give external proof beyond our own engineering.

We’re working toward a one-click full-backup download

Today you can export your payments, customers, and loans to spreadsheets yourself. An owner-triggered, downloadable full encrypted backup would let you keep a complete copy in your own hands at any moment.

We’re working toward a guided Excel import wizard

Bringing your existing book in is supported today but currently needs operator assistance. A guided upload-and-map wizard would make onboarding fully self-serve.

We’re working toward database-enforced tamper-evidence

The activity log is append-only in code today. Enforcing it at the database level and adding cryptographic chaining would make any tampering provably detectable.

We’re working toward multi-instance redundancy

The app currently runs as a single auto-restarting instance. Running multiple instances with shared brute-force state would add failover and survive restarts.

We’re working toward a backup-setup safeguard during onboarding

Off-site backups require connecting Dropbox and setting an encryption key. A prominent in-app warning would ensure no one believes they’re backed up before setup is complete.

Everything in the sections above is live today. Everything in this section is a plan, not a promise of a date.