This describes how we protect Side (the budgeting app), our API, and sites under *.sidebudget.app. It complements our Privacy policy and is maintained for transparency and partner questionnaires—not as legal advice.
Access to production systems (hosting, database dashboards, payment and bank partner consoles) is limited to those who operate Side. Production secrets live only in managed hosting configuration (for example Google Cloud Run environment variables), not in the mobile app bundle. Administrative tools are not shipped with production secrets exposed to end users.
User data in our database is protected with row-level access controls so authenticated clients can read and write only their own records. Highly sensitive fields (such as encrypted bank connection tokens) are stored in server-only tables that are not exposed to client API keys. Development and production use separate credentials and environments where feasible.
Accounts support strong passwords and email verification. Users may enable optional authenticator-based MFA (TOTP). When MFA is enabled, we step up verification before sensitive app use where our providers require it.
We aim to log only what we need to operate and debug issues. Production logs must not contain passwords, raw tokens, or full payment payloads. Incoming webhooks from partners (including Plaid) are verified before processing where those partners provide a verification mechanism. Certain webhook deliveries may be retained in audit tables for troubleshooting and replay detection.
Changes ship through version control. We apply dependency updates and reviews as part of ongoing maintenance. We do not claim enterprise-grade continuous penetration testing unless separately documented.
Suspected security issues: email sidebudget@gmail.com. We will investigate, contain where feasible, and notify affected users when required by law.
We rely on subprocessors—including hosting (Google Cloud), authentication/database (Supabase), bank connectivity (Plaid), payments (Stripe, Apple App Store, Google Play where applicable), subscriptions (RevenueCat), and push (Expo)—under their published terms and security programs.
Aligns with our Privacy policy. Users may request account deletion by contacting us.
We review this policy at least annually or when security practices change materially.