Data Protection & Security

iBudjetti is a private, invite-only personal-finance application operated for a single household. Security is governed by this documented policy, which defines how we identify, mitigate, and monitor risks to member data. It is reviewed at least annually and whenever the architecture changes. The administrator (reachable at support@ubiquitousoriginality.com) is responsible for information security, applies the practices below, and is the contact for security questions or reports.

• No open signup. New accounts require explicit administrator approval before first sign-in.
• Least privilege. Role-based access: members see only their own financial data; every query is scoped server-side to the signed-in user. Household roll-ups are opt-in and read-only.
• Sessions use HttpOnly, Secure, SameSite cookies; idle sessions are signed out automatically after 10 minutes.
• Production infrastructure runs on a private network with no inbound ports exposed to the internet. Public traffic reaches the application only through an outbound-only encrypted tunnel. Administrative host access is by key-based SSH from the local network only.
• The database accepts connections solely from the application's isolated container network — it has no public listener.
• Login attempts are rate-limited (8 per 5 minutes per account).

MFA is mandatory for every member, without exception. After creating an account, a member must enroll an authenticator-app code (TOTP) or a passkey (WebAuthn) before any part of the application — including bank linking via Plaid Link — is accessible. Backup codes are stored only as bcrypt hashes. Administrative access to the application requires the same MFA; access to our infrastructure providers (Cloudflare, Plaid) is protected by MFA on those platforms.

• All traffic is served over HTTPS with TLS 1.2 as the enforced minimum (TLS 1.3 preferred). Plain HTTP is redirected.
• HTTP Strict Transport Security is set for two years with includeSubDomains and preload.
• Connections to the Plaid API and all other third-party APIs are made exclusively over TLS.

• Plaid access tokens — the credentials that authorize reading your bank data — are encrypted at rest with AES-256-GCM. They are never sent to the browser and never logged.
• Sign-in passwords and passphrases are stored only as bcrypt hashes; 2FA backup codes are hashed the same way. Passkey private keys never leave your device.
• Financial records (transactions, balances) live in a database on hardware we physically control, on an isolated private network with no public exposure, accessible only through the access controls above.
• Database backups are stored on the same physically-controlled private infrastructure and rotated (see retention below).

• Every production build runs a dependency vulnerability audit (npm audit) and the results are reviewed before release.
• Application containers are rebuilt from updated base images on every deploy, picking up upstream security patches; framework versions are upgraded when security advisories affect us (e.g. Next.js CVE patches).
• The application ships hardened HTTP security headers: Content-Security-Policy, X-Frame-Options DENY, nosniff, Referrer-Policy, and Permissions-Policy.
• Administrator and member devices run current operating systems with automatic security updates and built-in malware protection enabled.

• What we store: your email, display name, and the financial data needed to run the app — account names and balances, transactions, holdings, budgets, and goals, retrieved from institutions you connect via Plaid or enter manually.
• Why: solely to provide you the dashboard, budgeting, reporting, and forecasting features. There is no advertising, no analytics resale, and your data is never sold or shared with third parties beyond the processors below.
• Processors: Plaid Inc. connects your financial institutions (see the Plaid End User Privacy Policy); Cloudflare provides network transport. Optional AI-assistant features send data only to the AI provider you configure with your own key, and only when you use them.
• Bank sign-in credentials are handled by Plaid and your bank directly — iBudjetti never sees or stores your banking username or password.

Creating an account requires agreeing to this policy. Connecting a financial institution additionally goes through Plaid Link, where you review and accept Plaid's consent terms for that institution before any data is shared. You can disconnect an institution or delete its data at any time from within the app.

• Your data is retained while your account is active, so the app can show history and trends.
• Self-service deletion: you can delete individual transactions, accounts, or disconnect a bank at any time — deletion also removes the connection at Plaid so no further data is collected.
• Full erasure: request account deletion from the administrator; the account and all associated financial records are permanently removed from the database (cascading delete).
• Operational backups are rotated and retained for a maximum of 90 days, after which deleted data is unrecoverable.
• This retention policy is reviewed at least annually alongside the security policy above.