Security at BudgetCal
You are trusting us with a picture of your household finances. Here is exactly where that data lives, who can reach it, and what we do to keep it safe.
Last updated: August 21, 2026
We never connect to your bank
BudgetCal does not ask for your online banking username, password, or account number, and we do not use bank aggregation services. You enter what you plan to spend. That means there are no banking credentials in our system for anyone to steal, and nothing here can be used to move money out of your accounts.
Your card never touches our servers
Subscription billing is handled end to end by Stripe, a PCI DSS Level 1 Service Provider, the highest level of payment security certification. Your card number is entered on Stripe infrastructure and stored by Stripe. We only ever see your billing email and the last four digits.
The database itself keeps accounts apart
Every table in BudgetCal is protected by PostgreSQL Row Level Security. Your rows are bound to your account ID at the database layer, so the database refuses to return your data to any other session. That protection holds even if our own application code asks for the wrong thing.
The infrastructure we build on
BudgetCal is a small, independent Canadian company, and we made a deliberate choice not to run our own servers. Instead we build on providers whose security is independently audited every year by third-party firms. The certifications below are held by those providers, and each one is verifiable on their own trust page.
| Provider | What they do for BudgetCal | Their certifications |
|---|---|---|
| Stripe, Inc. | Subscription payments and billing | PCI DSS Level 1 Service Provider |
| Vercel, Inc. | Application hosting, TLS, and DDoS mitigation | SOC 2 Type II, ISO 27001 |
| Supabase, Inc. | Database, authentication, and file storage, running on Amazon Web Services | SOC 2 Type II, HIPAA capable |
| Amazon Web Services | Underlying cloud and physical datacentre infrastructure | SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018 |
| Resend, Inc. | Transactional email and weekly digests | SOC 2 Type II |
| Twilio, Inc. | Optional SMS bill reminders | SOC 2 Type II, ISO 27001 |
| Anthropic PBC | AI receipt scanning, on the paid plan only | SOC 2 Type II |
| GitHub, Inc. | Source code management for the BudgetCal codebase | SOC 2 Type II, ISO 27001 |
To be clear about what these certifications mean: they are held by the providers named above, not by BudgetCal. They cover the platforms our software runs on. How we configure and operate BudgetCal on top of those platforms is our own responsibility, and that is what the next section describes.
How we operate
These are the controls we run ourselves, aligned to the ISO/IEC 27001 Annex A control set.
Multi-factor authentication
Every account that can reach BudgetCal production systems, including our hosting, database, payments, email, and source control, is protected by multi-factor authentication.
Least privilege on production credentials
Privileged database keys are held only by the company director, are never exposed to the browser, and live exclusively in server-side environment variables scoped to production.
Encryption everywhere
All traffic to BudgetCal runs over TLS. Data at rest is encrypted with AES-256 by our database provider. Passwords are never stored, only a one-way bcrypt hash that we cannot reverse.
Backups
Our database provider takes automated daily backups of the BudgetCal database so your data can be recovered after an incident.
Change management
All changes to BudgetCal are version controlled, reviewed before release, and deployed through an automated pipeline. Every release is traceable to the change that produced it.
Breach notification
If a security incident affects your personal data, we will notify affected users and the relevant privacy regulators as required by PIPEDA and the GDPR.
Where we are on independent certification
We would rather be straight with you than hide behind our providers' badges. BudgetCal itself is not yet independently certified to ISO/IEC 27001 or SOC 2. We follow controls aligned to those standards, and we will update this page the moment that changes. Any company that tells you it is “SOC 2 certified” because its hosting provider is has not told you the whole story.
What we never do
- Connect to your bank or ask for banking credentials
- Sell, rent, or trade your personal or financial information
- Show advertising, or share your spending data with any ad network
- Use your financial data to train AI models
- Install advertising trackers, pixels, or fingerprinting scripts
- Store your full card number anywhere in our systems
Our only revenue is your subscription. That is deliberate. It means the way we make money never depends on doing something with your data that you would not want.
What you control
Export your data at any time. Your accounts and every transaction you have entered can be downloaded as a CSV file from your profile menu, and opened in any spreadsheet. Your budget is never locked inside BudgetCal.
Delete your account permanently. Deleting your account from your profile menu removes your transactions, categories, attachments, and settings from our systems. It is not a soft delete or a hidden archive.
Protect your login. Use a strong password that you do not reuse anywhere else, and sign out on shared devices. BudgetCal also signs you out automatically after a period of inactivity.
Reporting a security problem
If you believe you have found a vulnerability in BudgetCal, please tell us before telling anyone else. We read every report, we do not take legal action against researchers acting in good faith, and we will keep you updated on the fix.
support@herolabsdigital.comWe aim to acknowledge every security report within 72 hours. Please include the steps to reproduce the issue, and please do not access, modify, or delete data belonging to anyone other than yourself while testing.