Security

Budgetmend, operated by Kaai Tech LLC, is built to protect your budgeting and financial data. We use industry-standard practices across authentication, encryption, access control, and third-party integrations. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

Our formal Information Security Policy is published and reviewed at least annually. For a list of service providers that process data on our behalf, see Subprocessors in our Privacy Policy.

• Email and password sign-in with verified email addresses
• Two-factor authentication (TOTP authenticator app) required before bank linking
• Firebase Authentication for secure session management

• All traffic between your browser and our servers uses HTTPS (TLS 1.2+)
• Data at rest is encrypted using industry-standard encryption through our cloud providers
• Bank-linking credentials are stored server-side only and are never exposed to the client application

• Application access controls ensure users can only access their own data
• Role-based access for administrative functions
• Production infrastructure access is limited to authorized personnel with multi-factor authentication

When you connect a bank, you must accept explicit consent and complete two-factor authentication. We use Plaid to retrieve transaction data you authorize. See our Privacy Policy for details on data collected through Plaid.

Subscription payments are processed by Stripe. We do not store full payment card numbers on our servers. Stripe handles card data under its own security and compliance programs (including PCI DSS). We receive subscription status, customer identifiers, and limited billing metadata needed to manage your account.

We monitor dependencies for known vulnerabilities, apply security patches based on severity, and keep platform software on supported versions.

Contact security@budgetmend.com to report a vulnerability or security concern. We aim to acknowledge reports within 2 business days.