How we protect your financial data.
All communication uses TLS 1.2/1.3. HSTS prevents protocol downgrade attacks. Content Security Policy blocks unauthorized script injection. Independently verified A+ on SecurityHeaders.com and Mozilla Observatory.
Via Plaid (SOC 2 Type II certified). Your credentials go directly to Plaid. DuoBudgets never sees them. Read-only access only. All Plaid API calls have a 30-second timeout to prevent hanging connections.
Every record is tagged with a household ID. Every API request verifies household ownership. It is technically impossible for one household to access another's data.
Passwordless SMS PIN login. PINs expire after 10 minutes and are single-use. Brute force protection enforces separate rate limits by IP (10 attempts/hour) and by phone number (3 attempts/10 minutes). Biometric login via WebAuthn. Sessions stored in PostgreSQL and expire after 4 hours of inactivity. Sign out all devices at any time from Settings.
Receipt images are stored in Cloudflare R2 with private access only, never publicly accessible. File content is verified by magic bytes (not just extension) before storage. Access requires an authenticated session and verified ownership of the associated budget entry.
We collect only what's needed, never sell data, and support data export and deletion. Contact [email protected] for privacy questions.
Found a vulnerability? Email [email protected]. We respond within 48 hours.