Security
Last updated 21 August 2026
Data isolation
Every table that holds your data has row-level security enabled with policies keyed to your user ID. Even a malformed query cannot return another person's rows.
Receipts and files
Receipt uploads go to a private bucket in a folder named after your user ID. Files are served through short-lived signed links only to you — there are no public URLs.
Transport and storage
All traffic runs over HTTPS. Data is encrypted in transit and at rest by the managed database and storage layer.
Bank connections
Where a bank connection is available, it is created through a regulated aggregation provider. We never ask for or store your online banking username or password, and connections are read-only.
Authentication
Sign-in uses email/password or Google. Passwords are salted and hashed by the auth provider; sessions are refreshed with rotating tokens and can be ended at any time by signing out.
Your part
Use a unique password, keep your email account secure, and sign out on shared devices. Delete your account any time from Settings if you want everything removed.
Reporting a vulnerability
Found something? Email support@budgetflow.ai with steps to reproduce. Please do not test against other people's accounts or run destructive scans. We aim to acknowledge reports within a few business days.