Talk to us
Request the MSA, DPA, and sub-processor list, or ask a security question. Request access
Security and compliance
SplitGoGo is a ledger and settlement engine. It holds the minimum data needed to track shared spending, and it is built so that a single database leak is not enough to impersonate a partner or read another tenant’s data.
Tenant isolation
Section titled “Tenant isolation”Every partner is a separate tenant. Every record belongs to exactly one
tenant, and queries are automatically scoped to the calling tenant. A request
can never read or write another tenant’s data; an attempt to reach a record
outside your tenant returns 404, so the existence of other tenants’ data is
never revealed. Uniqueness (for example your own user identifiers) is scoped per
tenant, not shared across the platform.
API keys
Section titled “API keys”- Keys are presented as
Authorization: Bearer spk_<env>_<secret>and are bound to one tenant and environment (test or live). - The full secret is shown once, at creation. It is never stored in plain text and never logged.
- Stored as an Argon2 hash combined with a server-side pepper, so the database alone cannot be used to recover or verify a key.
- Keys carry scopes (for example
transactions:write) so you can grant least privilege. Authentication details are covered in the developer documentation once you have access.
Encryption
Section titled “Encryption”- In transit: all API traffic is over TLS (HTTPS), with HSTS.
- Receipts at rest: receipt files are stored in a private object store with all public access blocked, encrypted at rest, and served only through short-lived signed URLs.
- Database at rest and hosting: data is hosted in the EU. TODO(zach): confirm the managed database host and at-rest encryption details for the security statement.
Auditability
Section titled “Auditability”The ledger is append-only. Transactions are immutable once recorded; a change is a new correcting transaction that supersedes the original, and the original is retained. Tenant-mutating actions are written to an audit log. The full history is preserved, and balances can always be recomputed from the record.
Data minimization and GDPR posture
Section titled “Data minimization and GDPR posture”- SplitGoGo stores minimal personal data about participants: a display name and an optional email. No addresses and no payment methods.
- Any additional context you attach is partner-controlled metadata that SplitGoGo treats as opaque and never parses.
- A Data Processing Agreement is available for partners. TODO(zach): link the DPA and sub-processor list.
Webhooks
Section titled “Webhooks”Outbound webhooks are signed with HMAC-SHA256. Each delivery includes a signature and a timestamp; verify both and reject deliveries older than five minutes to prevent replay. Webhook verification is documented in the developer documentation once you have access.