Security Practices

Bank connection tokens (Plaid access tokens) are encrypted using AES-256-GCM before being stored in our database. This is a military-grade encryption standard that ensures your bank credentials cannot be read even if the database were compromised. Each token is encrypted with a unique initialization vector and authenticated with a GCM authentication tag to prevent tampering.

All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS). This applies to every page load, API request, and webhook. Our hosting provider enforces TLS automatically with no option for unencrypted connections.

BarryBudget uses industry-standard OAuth 2.0 for authentication via Google. Sessions are managed using signed JSON Web Tokens (JWT) that are validated on every request. We do not store passwords — authentication is delegated to trusted identity providers.

Two-factor authentication (2FA) via authenticator app (TOTP) is available to all users and can be enabled in account settings. When enabled, a 6-digit code is required at each new login before any financial data or bank connections can be accessed.

We connect to your bank accounts through Plaid, a regulated financial data provider used by thousands of financial applications. BarryBudget has read-only access to your account information and transaction history. We cannot move money, make payments, or modify your bank accounts in any way.

All database queries are scoped to the authenticated user's ID. Every query that accesses user data includes a user ID filter, ensuring that users can only access their own information. There is no shared data between users.

Payment processing is handled entirely by Stripe, a PCI Level 1 certified payment processor. BarryBudget never sees, stores, or processes your credit card number. We only store a Stripe customer ID to manage your subscription.

Our infrastructure is hosted on trusted, SOC 2 compliant platforms:

• Vercel — application hosting with automatic TLS, DDoS protection, and edge network distribution.
• Supabase — managed PostgreSQL database with encrypted storage, automated backups, and network isolation.

Production infrastructure access is restricted to the sole operator. All service accounts (hosting, database, payment processing, bank data) are protected with multi-factor authentication.

We monitor dependencies for known vulnerabilities using automated tools. Critical security patches are applied promptly. Our application framework and libraries are kept up to date with the latest stable releases.

When you delete your account, all your data is permanently removed immediately — from our database and from connected third-party services (Plaid connections are revoked, Stripe records are deleted). No backup copies of individual user data are retained. See our Data Deletion & Retention Policy for details.