sessions
HTTP-only cookies
legal
Security posture.
BudgetR keeps public security statements tied to controls that are already present in the product.
passwords
bcrypt hashes
demo
read-only
Authentication
Password authentication stores bcrypt hashes. Production sessions use HTTP-only, Secure, SameSite=Lax cookies.
Access control
Personal, Tax, Trader, and Admin access are tiered. Protected workspaces and tRPC procedures enforce session and tier checks, data-access code is designed to scope records to the session user, and admin rights come from a database-backed role with a recovery allowlist.
Abuse protection
Login, registration, and demo endpoints are rate-limited per network address, and demo sessions are blocked from all write operations at the API layer.
External credentials
Plaid handles bank credential collection. BudgetR receives the tokens and account data needed to sync supported accounts.
Security contact
Security questions, suspected vulnerabilities, and diligence requests can be sent to the security inbox for review.
security@budgetr.ai