Security

A budgeting app that links to your bank has to earn your trust. This page explains, in plain language, what protects your account and your data today, and what we're still adding.

Your bank login never reaches us

You link a bank inside Plaid Link, which Plaid runs. Your bank username and password go to Plaid, not to us. We store the account names, the last few digits of account numbers, balances, and posted transactions, as listed in our privacy policy. We never receive full account or routing numbers.

In place today

• Two-step verification before linking a bank. You need an authenticator app before you can link a bank, and once you have one, our database requires the verified sign-in for every request, not just the app. You can add a second authenticator as a backup.
• Changes to two-step verification need a fresh code. Removing an authenticator or adding another one needs a recent code from one you already have, so someone with a stolen session can't swap in their own. The last authenticator can't be removed while a bank is linked.
• Each user can reach only their own data. Every table in our database has row-level security rules, and automated tests fail if a new table is added without them.
• Bank access tokens are locked away. The token that lets us fetch your transactions is stored encrypted, is never sent to your devices, and every use of it is logged.
• Encryption. All connections use HTTPS/TLS, and the database is encrypted at rest. On iPhone, iPad, and Android your sign-in session is encrypted with a key kept in the device's secure storage.
• Signing out means signed out. Our server functions reject a signed-out session right away, and once two-step verification is on, so does the database. Removing one of two authenticators cuts off the sessions that signed in with it at once.
• Verified bank updates. Update notices from Plaid are accepted only with a valid Plaid signature.
• Limits against abuse. Linking banks and syncing have per-user limits.
• A locked-down web app. The web app only loads code from itself and from Plaid, and can't be placed inside another site's frame.
• Real account deletion. Deleting your account in the app deletes your account, budget, and bank data right away and tells Plaid to remove your bank connections. A few security records are kept for a limited time: a record of bank links, unlinks, and deletions with no email or transactions ([DECIDE: 1 year]), the sign-in security log with your email and IP addresses ([DECIDE: 90 days]), database backups ([CONFIRM: backup retention]), and hosting logs ([CONFIRM: log retention]). [PENDING: purge jobs not built yet, SwiftBudget todo 117-118] See Delete your account.
• Protected admin access. The administrator accounts that run the service use two-step verification, and dependency security alerts are turned on for our code.

Planned

• A challenge on sign-up and password reset to slow automated abuse.
• Recovery codes for two-step verification.
• A written information security policy with regular access reviews (drafted, not yet adopted).
• A dedicated email delivery provider for account emails.

Report a security problem

If you think you've found a security issue, email support@vimabudget.com [PLACEHOLDER: a dedicated security address, such as security@vimabudget.com]. Please don't test it on accounts that aren't yours. We'll reply as soon as we can.