When building a financial data tool yourself, how do you ensure data privacy and security are handled properly?

The presenter said they no longer do the engineering themselves, focusing instead on the real-estate-specific logic (amortization tables, loans, splits, etc.), while a group of long-time contractors with software/data backgrounds handles engineering, brought on specifically when they decided to commercialize the tool. They have real testing in place. Security is built around Supabase and RLS (row-level security). The system is read-only — it doesn't originate any transfers, and users cannot send or receive money through it. They described this as 'choice editing': deliberately removing possibilities for risky actions rather than just relying on permissions, and noted they are currently working on additional data privacy measures.