Security at DeX Agent

DeX Agent handles three kinds of sensitive information — your calendar, your bank balances, and access to your servers. This page explains, in plain language, how each is protected. It summarizes the Belmont Labs Information Security Policy, which is reviewed at least annually.

Your bank data

• Read-only. We use Plaid's Balance and Transactions products only. No product that can move money is enabled, so no part of DeX Agent is capable of initiating a payment or transfer.
• Your bank login stays with your bank. Linking opens your bank's own sign-in page (for Bank of America and most major banks this is OAuth). Neither the app nor our servers ever see your bank username or password.
• Tokens are encrypted. The access token Plaid gives us is encrypted with AES-256-GCM before it is stored, and decrypted only in memory when we fetch your balances. The encryption key lives only in the server's environment — never in code, never in the database, never in backups.
• Balances are never stored. Balances and transactions are fetched from Plaid when you open the Money tab, held in memory for at most five minutes, and never written to disk. We store only Plaid's opaque account identifiers — no account names, numbers or amounts.
• Face ID before anything. The Money tab requires Face ID or Touch ID (device passcode fallback) every time the app comes to the foreground, and again immediately before a bank is linked.
• Unlink any time. Unlinking in the app revokes the connection at Plaid and deletes the token.

Your account and Dex's memory

• Passwords are stored only as bcrypt hashes. Sessions use signed tokens kept in the iOS Keychain.
• Everything Dex remembers about you, and your recent conversation, is encrypted at rest with AES-256-GCM. You can view and clear it in Settings.
• Every request to our servers is tied to your account by the session token, and every database query is scoped to your user id. There is no path that returns another user's data — including between members of the same company.

Your calendar

Calendar access is on-device, through Apple's EventKit. Events are not uploaded or stored by us. When you ask Dex a question, a short text summary of today's events is sent along with your question so Dex can answer it; it is not retained.

Your servers

Dex monitors servers you add with read-only health checks over SSH. The private key it uses is encrypted at rest with AES-256-GCM. Dex never runs commands that change anything on your servers.

Our infrastructure

• All traffic uses TLS 1.2 or better, with certificates renewed automatically.
• The database accepts connections only from the application server itself; it is not reachable from the internet.
• Production access is limited to a single administrator using SSH key authentication; password logins are disabled. Administrative accounts (hosting, Plaid) are protected with two-factor authentication.
• Operating system security updates are applied automatically. Other components are patched within a defined window: critical within 7 days, high within 30, everything else within 90.
• The database is backed up nightly and backups age out after 14 days, so deleted data leaves them within two weeks.

Third parties

If something goes wrong

We treat anything that exposes, alters or blocks access to user data outside its intended path as a security incident, whether or not harm is confirmed. Affected users are notified within 72 hours of confirmation. Report concerns to security@dex-agent.com.