Security & data

Security is a set of clear boundaries, not a promise to “just trust us”

This page explains which data you maintain, how integration credentials are protected, how external requests are bounded, and what the system and user each do after a failure.

You confirm the records

Subscriptions, amounts, currencies, and dates come from your input. TutuYes does not read bank transactions or present planning summaries as final invoices.

Upstream authentication is protected separately

HTTP Pull authentication settings are encrypted server-side with AES-256-GCM. If a deployment lacks a valid master key, new sensitive writes are explicitly rejected instead of silently stored as plaintext.

Treat webhook details as credentials

Generic webhooks support signature and timestamp checks plus replay deduplication. Do not put URLs, tokens, or secrets in public frontend code or chat; rotate them after exposure.

Outbound requests have network boundaries

HTTP Pull blocks private, loopback, and link-local targets by default, rejects credentials embedded in URLs, and does not follow redirects to reduce SSRF and redirect bypass.

Resources are not unlimited

Pull requests have time and 1MB response limits. Webhooks have a 256KB body limit and rate limits, so oversized or abusive requests fail instead of consuming resources indefinitely.

Failures can be seen and recovered

Connection failures leave error state and later successful checks can recover. Incoming events have receipt deduplication, while interrupted notification sends have a background recovery path.

What to do when something looks wrong

  1. 1Disable or rotate the affected connection first so old credentials stop working.
  2. 2Update the sender, then test success, invalid signatures, limits, and retry behavior.
  3. 3Check the original provider invoice and date to ensure your record did not become stale during the interruption.
  4. 4If support is needed, share the time, connection type, and safe error details—never the full secret.

The final action remains yours

Disabling or deleting a record in TutuYes does not cancel it at a registrar, SaaS vendor, cloud provider, or payment institution. Confirm every payment, refund, contract, and auto-renew change at the original service.