Security Best Practices
Maximize your account security with our recommended practices
Your Dual-Layer Security System
Lock uses a two-factor security model to protect your data:
Google OAuth
First Factor: Securely authenticate with your Google account (something you HAVE)
Master Password
Second Factor: Unlock your vault with Zero-Knowledge encryption (something you KNOW)
This is the same security model used by professional password managers like 1Password and Bitwarden
What We Can and Cannot See
Understanding exactly what data is encrypted and what remains accessible for features:
Zero-Knowledge Encrypted
Nobody can access these - not hackers, not Lock staff, not even us:
- Your actual passwords - Encrypted on YOUR device before storage
- Recovery keys - Zero-knowledge encrypted
- Master password - Never leaves your device
- Sensitive document content - Encrypted before upload
Metadata (Functional)
Required for features like reminders, digests, and analytics:
- Account names - e.g., "Chase Credit Card"
- Payment amounts & due dates - For financial tracking
- Security scores - Calculated in browser before storage
- Bill/reminder metadata - Categories, notes, amounts
The tradeoff: To provide intelligent features like weekly financial digests ("You have $500 due next week") and security alerts ("3 weak passwords detected"), Lock needs access to this metadata. Your actual password values remain zero-knowledge encrypted - we literally cannot see them even if we wanted to.
Enable 2FA on Your Google AccountCRITICAL
Since Lock uses Google OAuth for authentication, strengthening your Google account security directly protects your vault.
How to enable:
- Go to myaccount.google.com/security
- Under "How you sign in to Google," select "2-Step Verification"
- Follow the setup instructions (SMS, Authenticator App, or Security Key)
- Enable backup methods in case you lose access to your primary 2FA device
Use a Strong Master PasswordESSENTIAL
Your master password is the key to your Zero-Knowledge encrypted vault. Make it strong and memorable.
Strong password guidelines:
- At least 16+ characters - Longer is exponentially more secure
- Use a passphrase - "CorrectHorseBatteryStaple2025!" is better than "P@ssw0rd!"
- Mix characters - Uppercase, lowercase, numbers, and symbols
- Never reuse - This password should be unique to Lock only
- Avoid personal info - No birthdays, names, or common words
Securely Store Your Recovery KeyIMPORTANT
Your Recovery Key is your only way to reset your master password. Treat it like a physical safe key.
Best practices for Recovery Key storage:
- Print it out and store in a safe or lockbox
- Store offline - Don't email it or save it in cloud storage
- Make multiple copies in different secure locations
- Tell a trusted person where to find it in case of emergency
Download Regular Backups
While Lock is reliable, having your own backup copy provides extra peace of mind.
Use the "Download Backup" feature in your profile menu to save an encrypted copy of your data. Store this backup file in a secure location separate from your devices.
Secure Your Devices
Your device security directly impacts your vault security.
- Enable device lock (PIN, fingerprint, Face ID)
- Keep your operating system and browser updated
- Use antivirus software on computers
- Be cautious on public WiFi networks
Your Security Checklist
Information Security Policy
Lock is a cloud-based, cross-platform digital App, built on the Base44 platform and owned and managed by Perks Express Inc. — Effective Date: April 2026
Encryption
All sensitive user data is encrypted client-side using AES-256-GCM (Zero-Knowledge Encryption) before transmission. No plaintext vault data is stored on our servers.
Authentication & Access Control
User authentication is handled via Google OAuth 2.0. Role-based access control (RBAC) is enforced at the application layer. Only authorized personnel have access to production systems.
Data Transmission
All data is transmitted over HTTPS/TLS. Plaid API tokens are stored server-side only and never exposed to the client.
Data Retention
User data is retained only as long as the account is active. Users may request deletion at any time via support@locked4you.com.
Incident Response
Security incidents are reported to users within 72 hours of discovery via email notification.
Third-Party Vendors
Production infrastructure is hosted on Base44 (SOC 2 compliant). Payment processing via Stripe (PCI-DSS compliant).
Multi-Factor Authentication (MFA) Policy
Lock is a cloud-based, cross-platform digital App, built on the Base44 platform and owned and managed by Perks Express Inc. — Effective Date: April 2026
MFA Method
Lock deploys non-phishing-resistant multi-factor authentication (MFA) for all consumer accounts. Authentication is performed via Google OAuth 2.0, which supports standard second factors including SMS codes, Google Authenticator (TOTP), and backup codes.
When MFA is Applied
MFA is applied at the consumer login stage — before Plaid Link is surfaced. Users must fully authenticate via Google OAuth (including any 2FA configured on their Google account) before accessing any Plaid-connected features.
Vault Master Password as Second Factor
In addition to Google OAuth, Lock requires users to enter a Master Password to unlock their encrypted vault. This Master Password is zero-knowledge encrypted and never transmitted to Lock servers, providing an additional authentication layer beyond Google OAuth.
MFA Enforcement Scope
MFA is enforced on both the web application (lock.app) and mobile PWA (Progressive Web App) versions of Lock. All platforms share the same Google OAuth authentication flow.
Compliance Statement
Lock's MFA implementation satisfies Plaid's requirement for consumer authentication prior to Plaid Link being surfaced. Authentication type: Non-phishing-resistant MFA via Google OAuth 2.0 + Master Password second factor.
MFA Policy — Critical Systems Access
Covers admin/internal access to systems storing or processing consumer financial data
Lock is a cloud-based, cross-platform digital App, built on the Base44 platform and owned and managed by Perks Express Inc. — Effective Date: April 2026
Scope
This policy covers MFA requirements for internal administrative access to all critical systems that store or process consumer financial data, including the application database, backend functions, payment infrastructure, and third-party vendor dashboards.
Application Infrastructure (Base44)
Lock's production infrastructure is hosted on Base44, a SOC 2 compliant platform. Administrative access to Base44 (database, backend functions, deployments) is protected by Google OAuth 2.0 authentication with standard MFA available to all administrators.
Payment Infrastructure (Stripe)
Payment processing is handled by Stripe (PCI-DSS compliant). All access to the Stripe dashboard, which contains consumer payment data, requires MFA via Stripe's built-in authentication controls.
Admin Panel Access
The Lock application admin panel requires authenticated login via Google OAuth 2.0 with role-based access control (RBAC). Only users with the "admin" role can access admin-level features. Admin accounts are required to have MFA enabled on their Google account.
Plaid API Tokens
Plaid API tokens are stored server-side only and never exposed to the client. Access to server-side functions that handle Plaid tokens is restricted to authenticated admin sessions only.
Compliance Statement
MFA is in place for all administrative access to critical systems storing or processing consumer financial data. Authentication type: Non-phishing-resistant MFA via Google OAuth 2.0 across all admin-level system access points.