Security

What MatchRail stores, who else processes it, and how to report a vulnerability.

Reporting a vulnerability

Email hello@kynth.studio. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.

The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.

Accounts

MatchRail has user accounts. What is stored against one, and who else touches it, is below.

What is stored

  • Your account: the email address you sign in with, and the ledger you connect
  • Your purchase orders, bills and payments as read from that ledger, and the goods receipts you record here — neither QuickBooks Online nor Xero has a receipt entity, which is the gap this product exists to fill
  • Every match the agent ran, every variance it found and every correction you approved, because that record is what makes the kill window provable rather than asserted
  • Anonymous usage analytics — page views and clicks. Form inputs are masked in session recordings

Who else processes data

  • Supabase — authentication and the database holding your orders, receipts, bills and match history
  • Intuit QuickBooks — one of the two ledgers a book is read from and a correction you approved is written back to
  • Xero — the other, under exactly the access you granted
  • Stripe — reads the payments so a bill paid before its match passed is flagged rather than quietly closed, and takes your own subscription payment
  • PostHog — anonymous product analytics, proxied through this domain
  • Vercel — serves this site and holds its access logs

Also true

  • The paid plans are PRO at $39/month and FIRM at $179/month; the free plan needs no card.
  • It does not move money. There is no payment run and no payout rail in this product.
  • The matcher is arithmetic, not a language model. Nothing about whether two documents agree is decided by a model.
  • Nothing is written back to your ledger without you approving that specific correction, and it refuses to post a figure that changed after you approved it.
  • Every action the agent takes is written to an append-only ledger with the evidence it acted on, including the ones nobody looks at. That record is what makes the kill window provable rather than asserted.
  • There is no password on this product. Sign-in is a link sent to your email address, so there is nothing to reuse, leak or reset badly.
  • Your data is scoped to your organisation at the database level, not only in the interface.

MatchRail is built and run by Kynth Studios. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.