Security

Last updated November 4, 2026

We protect personal and financial data with controls that match industry practice for consumer financial apps.

Data protection

• Encryption at rest (AES-256) for stored data and backups, with secrets kept in encrypted storage.
• Encryption in transit with TLS 1.2 or higher for every connection.
• Systems are not exposed to the public internet, and backups are encrypted.
• Bank access tokens are stored encrypted and never shown in the app or in logs.

Your data, your key

• Your data is encrypted with its own encryption key.
• Your backups are encrypted with a key that only you hold. It isn't stored on our systems.
• No one at Buddy Labs looks at your data unless you ask us to (for example, for support) or the law requires it, and access to systems is restricted and logged.
• You can disconnect accounts and delete your data at any time.

Access control

• A written access control policy, with role-based, least-privilege access.
• Centralized identity with multi-factor authentication for all administrative access.
• Periodic access reviews, with records kept.
• A defined process to remove access promptly when someone leaves or changes role.

Operations

• Automatic security updates and regular vulnerability scanning of systems and code.
• Monitoring for configuration changes, exposed services and leaked credentials.
• Regular rotation of keys and credentials.
• Data minimization and defined retention periods. See the Privacy Policy.

Reporting a security issue

Email security@buddylabs.io with "Security" in the subject. We aim to reply within 3 business days.