Your data stays yours.
Mythox holds your money, your work, and your day, so it is built security first. Here, in plain English, is exactly how your information is protected.
Isolated to you
Your data is fenced off to your account by the database itself, using per-user Row-Level Security. The browser only ever sees the signed-in user's own data, and the powerful server key never reaches the browser.
Encrypted in transit and at rest
Every connection uses HTTPS with TLS 1.2 or higher. Your stored data is encrypted at rest with AES-256 on our managed database platform.
Secrets stay server-side
API keys and tokens live in a managed secret store. They are never placed in the browser, never written into the code, and never logged.
Your data is isolated to you, and encrypted.
The protection is built into the data layer, not just the app. Even if the app code had a bug, one account still cannot read or change another account's data. That isolation, plus encryption in transit and at rest, is the foundation everything else sits on.
Bank connections through Plaid
You enter your bank credentials into Plaid's own secure screen, so Mythox never sees or stores your bank username or password. The connection is read-only and tokenized. The access token and your data stay server-side and encrypted, isolated to your account. You can disconnect anytime, which revokes the token. US banks only today.
Payments run on Stripe
Your card details are handled by Stripe, not stored by Mythox. When a creator sells through Mythox, the sale runs on that creator's own connected Stripe account.
Your bank and card details never touch us.
The two places you are most careful about, your bank and your card, are handled by Plaid and Stripe on their own secure screens. Mythox works from a read-only, tokenized connection, so the sensitive credentials stay with the providers built to hold them.
Two-factor authentication
Available in Settings with an authenticator app (TOTP), required to connect a bank, and protecting the administrative consoles.
Guardrails on the AI
Midas runs under a frozen, tamper-resistant scope policy. It is read-only on money and credentials (with redaction), can only write to a tiny allow-list, never deletes, never runs raw database commands, and never exposes tokens. This is verified by automated tests.
Every release is security-reviewed
Each meaningful change passes an automated security-review gate before it ships. Findings are fixed and re-checked before release.
Least privilege, everywhere, including the AI.
People and components get only the access they need, and nothing more. That principle covers your login, our admin access, and the in-app AI, which is deliberately boxed in so it can help you without being able to touch what it should not.
Security questions? Talk to a human.
Email support@mythox.ai for anything security or privacy related, including a suspected issue. For the full detail, read the Privacy, Terms, and Security policy.