Security
How Montaris protects
your information.
Montaris holds families’ financial records, so it was built security-first — and this page states plainly what protects yours. Everything here describes the system as it runs today.
Getting in
Every account requires two-factor authentication — a password alone is never enough. Sign-ins expire after 7 days, then password and code are required again. Passwords known from public data breaches are rejected outright.
What you can see
Permissions are enforced inside the database itself, row by row — not just in the app. You see the holdings you've been granted and nothing else, and no software bug in a page can override that. Each family's records are fully isolated from every other family's.
Even a stolen password reads nothing
A second, database-level lock denies all data access to any session that hasn't completed two-factor verification. Someone who steals a password — but not your phone — gets nothing.
The document vault
Documents live in private storage — never on the public internet. When you open one, it's served through a link that expires in seconds. Everything is encrypted in transit and at rest.
The assistant answers as you
Montaris reads records through your own permissions when it answers you, so a reply can never reveal something you aren't allowed to see. When it doesn't know, it says so and passes the question to your family's administrator — it does not guess.
Behind the scenes
The database is backed up daily, with an independent second backup kept off-platform. The codebase is security-reviewed, dependencies are patched, and every operator account above the platform — hosting, database, code, email — is itself protected by two-factor authentication.
What we ask of you
Use a strong password that you don’t use anywhere else, keep two-factor authentication on the phone you carry, and know this: Montaris will never email or message you asking for your password or a sign-in code. If anything ever claims to, don’t answer it — tell your family’s administrator.
Said plainly
Montaris does not claim formal third-party certifications such as SOC 2 or ISO 27001. The infrastructure it runs on — Vercel for hosting and Supabase (on AWS) for the database and storage — carries those providers’ own industry certifications. The platform’s codebase and access rules were last independently reviewed in June 2026, and the protections above were verified against the running system. If you have a question this page doesn’t answer, ask Montaris inside the portal — if it can’t answer, your question goes straight to the family’s administrator, and the answer comes back to you in the same conversation.