Security Policy

The SuSu App is a financial technology platform. We implement layered security controls to protect user accounts, group savings activity, and payment flows processed through Stripe Connect.

• All payments are processed through PCI-DSS compliant Stripe — we never store full card or bank account numbers
• Identity verification (KYC) for payouts is handled entirely by Stripe Connect
• ACH and card transactions use industry-standard encryption in transit (TLS)
• Fees and charges are disclosed before you confirm each payment

• Single-device session enforcement to reduce unauthorized account sharing
• Biometric authentication support (Face ID / Touch ID) on supported devices
• Optional passcode protection for app access
• Firebase App Check to verify requests come from authentic app installations
• Rate limiting and fraud monitoring on sensitive operations

• Data encrypted in transit and at rest
• Firebase Security Rules restrict database and storage access to authorized users
• Sensitive configuration stored in the iOS Keychain on device
• Regular dependency updates, security reviews, and monitoring

• Use a strong, unique password and enable biometric login when available
• Never share your login credentials or one-time codes
• Do not share bank details, passwords, or PINs in group chat
• Report suspicious activity to support@thesusu.app immediately

If we become aware of a security incident affecting your account, we will investigate promptly and notify affected users as required by applicable law. Contact support@thesusu.app to report security concerns.

BigE Solutions LLC
Email: support@thesusu.app