OpenBooks is bring-your-own-keys and self-hosted. Before you paste a Plaid secret, a Stripe restricted key, or an AI provider key into your own deployment, here is exactly how that secret is handled — with file citations you can check yourself. This is a lean, honest, code-cited statement, not a marketing trust page.
Plaid access tokens, Stripe restricted keys, Plunk keys and your AI provider key are encrypted with AES-GCM before they touch the database. The key is derived per-ciphertext via HKDF-SHA-256 from a deployment secret and is never written to the database — no key, no stored credential.
grep -n "AES-GCM\|deriveHkdfKey" convex/secretBox.tsSaving or listing a credential returns only redacted metadata — a one-way fingerprint, a short key preview (sk_live_…1234) and a status. The plaintext key or token never leaves the server. Resolved plaintext exists only inside server-side actions.
grep -n "keyPreview\|fingerprint\|maskKeyPreview\|credentialStatus" convex/credentials.tsLive Plaid (development/production) and live Stripe keys are supported locally and in self-host; there is no sandbox/test-only ban. The retained guarantee is that live connectors need a stable HTTPS origin for OAuth redirects and webhooks — an http:// origin cannot safely receive a live bank or payment callback.
grep -an "requires an HTTPS\|sk_live_" convex/connections.tsAuthorization is never trusted from the client. Every query, mutation and action re-checks the caller's workspace/entity permission on the server before reading or writing — dozens of backend modules call a shared authz helper.
grep -rl "requireWorkspacePermission\|requireUserId" convex/*.ts | grep -v test | wc -lThe repository never contains a real secret or private financial record. .gitignore ignores .env and .env.* and allowlists only .env.example (placeholders). A secret-scan gate (planned, E13-T8) fails the build on any real key shape in tracked docs or pages.
git ls-files | grep -E '^\.env' # prints only .env.example