Security policy
How we protect your family's data and bank connections, who is responsible, and how to report a problem.
Last reviewed 25 October 2026. Reviewed at least once a year, and whenever how we host or handle data changes.
1. Who is responsible
Budget AI is run by a single developer, Alireza Esmaeili (founder), who is responsible for information security: this policy, access to production, responding to incidents, and answering security questions. Contact alireza.es@gmail.com.
2. What we protect
- Account data: names, email addresses, password hashes, sessions.
- Budget data: transactions, balances, categories, goals and notes, kept in a separate database for each family.
- Bank connections: Plaid access tokens, which allow read-only access to a family's transactions and balances. We never receive bank usernames or passwords: people log in to their bank inside Plaid's own window.
- Secrets: Plaid, Google sign-in, email and AI provider keys.
3. Access control
- Production runs in one Google Cloud project. Only the founder's Google account has access, and it must use two-step verification. The same applies to the GitHub account that holds the code and the Plaid dashboard.
- Server access uses Google Cloud OS Login, tied to that Google account. No SSH keys or passwords are stored on the server or in the code.
- Deployments run from GitHub Actions using keyless, short-lived credentials (Workload Identity) for a deployer account that has only the permissions it needs. Its SSH access expires after 30 minutes.
- Inside the app, each family can only ever read its own database. Family owners and members have different rights, and only the site admin can change site-wide settings.
- Passwords are stored only as salted scrypt hashes. Login sessions are stored only as hashes, so a copy of the database can't be used to log in. People can also sign in with Google instead of a password.
- Anyone can turn on two-step login with a passkey (Face ID, Touch ID, Windows Hello or a security key, which can't be phished) or an authenticator app, with one-time recovery codes for a lost device. It is required before connecting a real bank, so Plaid's window only opens for someone who has passed both steps.
- Access is reviewed every three months (Google Cloud permissions, GitHub and Plaid team members), and keys are rotated whenever access changes or a leak is suspected.
4. Encryption
- In transit: the site and app are served only over HTTPS (TLS 1.2 or newer), with certificates renewed automatically. Calls to Plaid and other providers also use HTTPS.
- At rest: the server's disk and the backup storage are encrypted by Google Cloud (AES-256). The databases and the secrets file can't be read by other users on the server, only by the app's own service account and the administrator.
- Secrets are never written into the code, its history or documentation. They live only in a protected file on the server, or in the site's own database on the encrypted disk.
5. Secure development and vulnerability management
- Every change goes through version control and an automated pipeline: type checks and over 300 automated tests (including tests that one family can't see another's data) must pass before anything is deployed.
- Dependencies are scanned on every change: the build fails if a production dependency has a known high or critical vulnerability. Dependabot proposes dependency and security updates every week.
- The server installs operating-system security updates automatically every day.
- Known vulnerabilities are fixed within 7 days when critical or high, and within 30 days otherwise.
6. Backups and recovery
Databases are backed up every night to encrypted Google Cloud Storage and kept for 30 days. The restore procedure is written down. The previous release stays on the server for an immediate rollback.
7. Incidents
If we suspect a breach, we: (1) contain it, by revoking or rotating the affected keys and disconnecting affected bank connections at Plaid; (2) find out what was affected and how; (3) tell affected families, and Plaid where bank data is involved, without undue delay and within 72 hours of confirming it; (4) fix the cause and write down what we changed.
8. Your data and your rights
- Bank sync only starts when you choose it and give consent in Plaid's window. You can disconnect a bank at any time; the connection is also removed at Plaid.
- You can export your transactions or a full backup at any time from Settings.
- When a family owner deletes their account, the family's data is deleted from our live database and every bank is disconnected at Plaid. A member who deletes their account removes only their own login. Backups that still contain deleted data expire within 30 days.
- We don't sell data or use it for advertising. See the privacy policy for what we store and who else sees it.
9. Reporting a vulnerability
Found a security problem? Email alireza.es@gmail.com with the details. We'll reply within 3 business days and keep you updated until it's fixed. Please give us a reasonable time to fix it before disclosing it, and don't access or change other people's data while testing.