Security
How Montaris protects
your information.
Montaris holds families’ financial records, so it was built security-first — and this page states plainly what protects yours. Everything here describes the system as it runs today.
Getting in
Every account requires two-factor authentication — a password alone is never enough. A passkey (Face ID, Touch ID, Windows Hello) on a device you enrolled counts as password and code together. Passwords known from public data breaches are rejected outright.
What you can see
Permissions are enforced inside the database itself, row by row — not just in the app. You see the holdings you've been granted and nothing else, and no software bug in a page can override that. Each family's records are fully isolated from every other family's.
Even a stolen password reads nothing
A second, database-level lock denies all data access to any session that hasn't completed two-factor verification. Someone who steals a password — but not your phone — gets nothing. Eight wrong codes in fifteen minutes end every session of the account and pause sign-in for a quarter of an hour, and a sign-in expires on its own after seven days, or sooner when it goes unused.
The Inner Vault
The vault door asks for a fresh authenticator code every time, and only from an authenticator that was on the account before this sign-in began; a second authenticator opens nothing for its first 24 hours, and the account's owner and the family's administrators are told the moment one is added. The passport reader runs on your own device with an engine served from this site, never from a public code host. Every page also carries a strict browser policy that lets no script run unless the site itself produced it.
The document vault
Documents live in private storage — never on the public internet — and a file is readable only by the people who may see its record. When you open one, it's served through a link that expires within a minute; the cover photos on the Holdings page use links that last up to twelve hours. Sealed vault files sit in a separate store no member session can reach. Everything is encrypted in transit and at rest by the storage provider; the platform's operator can technically reach stored files.
The assistant answers as you
Montaris reads records through your own permissions when it answers you, so a reply can never reveal something you aren't allowed to see. When it doesn't know, it says so and passes the question to your family's administrator — it does not guess.
Behind the scenes
The database is backed up daily to an encrypted, separate repository. The codebase was security-reviewed in June and September 2026 and the findings are being fixed in order; dependencies with known advisories are tracked in that review. Every operator account above the platform — hosting, database, code, email — is itself protected by two-factor authentication.
What we ask of you
Use a strong password that you don’t use anywhere else, keep two-factor authentication on the phone you carry, and know this: Montaris will never email or message you asking for your password or a sign-in code. If anything ever claims to, don’t answer it — tell your family’s administrator.
Said plainly
Montaris does not claim formal third-party certifications such as SOC 2 or ISO 27001. The infrastructure it runs on — Vercel for hosting and Supabase (on AWS) for the database and storage — carries those providers’ own industry certifications. The platform’s codebase and access rules were reviewed in June and September 2026 with an AI security review, not by an outside firm; the September findings are being fixed in order and the protections above were verified against the running system. If you have a question this page doesn’t answer, ask Montaris inside the portal — if it can’t answer, your question goes straight to the family’s administrator, and the answer comes back to you in the same conversation.