Security

In place today

These are properties of the software as it exists, each covered by automated tests:

• Every record belongs to one person, and the database itself refuses to show it under anyone else's identity. The application's database login cannot switch this off.
• With no identity set, the application can read nothing at all.
• Your plan's history is append-only for the application: it cannot rewrite or delete what happened.
• A decision is applied once, even if the request is repeated, and is refused if your plan changed since you last saw it.
• Deleting your account marks it read-only at once and removes everything after 14 days, including at Plaid and at the sign-in provider; during the window one press keeps it.

Your bank credentials

You sign in to your institution through Plaid. Buttercup never receives your bank username or password, and cannot move money.

Sign-in and devices

Passwords are at least 12 characters and are checked against known breaches before they are accepted. Two-step verification with an authenticator app is available to every account. Every signed-in device is listed, and any of them can be signed out from another. Connecting or disconnecting an institution, changing credentials, exporting data and deleting the account ask for a recent sign-in first.

Institution access tokens

The token that lets the service read an institution's records is encrypted a second time by the application itself, under a key that is not stored in the database, so a copy of the database alone does not yield a usable token. The key is rotated on a written procedure. Disconnecting invalidates the token at Plaid and replaces the stored envelope with one that opens to nothing.

How security is run

A written information security policy covers access control, encryption, vulnerability management with patching deadlines, and incident response, including notice to affected people within 72 hours of a confirmed breach of their data. Dependencies are scanned on every change and the build fails on a high or critical advisory. A written retention and deletion policy states what is kept and for how long, and the deletion it describes is built.

Reporting a vulnerability

Write to security@withbuttercup.com. Reports are acknowledged within 3 business days. Please do not test against other people's accounts; a test account of your own is welcome.

In the browser

Every response carries a strict content security policy (scripts only from this site and tagged per request, nothing may frame the site, only the bank-connection window may be framed), HTTP strict transport security, and the usual hardening headers. Sign-in, sign-up, reset and second-step forms are rate limited per address.