Security at BucuBux

BucuBux holds people's bank connections, balances and transactions. Here's how we protect them, and how to tell us if you find a problem.

How we protect your information

• Your bank sign-in never reaches us. Banks connect through Plaid; BucuBux receives account data, never your bank password.
• Encrypted everywhere. HTTPS with TLS 1.2 or newer for every connection; data encrypted at rest; bank access tokens encrypted again with our own key, kept apart from the database.
• Strong sign-in. A new device has to prove it's you with a second step; you can use an authenticator app, see every sign-in, and end any of them. Our staff sign in with a password and an authenticator code, and never see your balances or transactions.
• Least access, logged. Every change to your data and every staff action is recorded. Production systems are reachable only by the service itself and a few named people with two-factor sign-in.
• Checked continuously. Every code change is tested and scanned for vulnerabilities before it ships, and scans run again every week.
• Your choices. You decide which banks to connect, can download all your data, and can delete your account and everything in it at any time. See our privacy policy.

Reporting a vulnerability

If you think you've found a security problem in BucuBux (bucubux.app, bucubux.com, our API or our phone apps), please email security@bucubux.com with what you found and how to reproduce it. We'll confirm we received it within 3 business days, keep you informed, and tell you when it's fixed.

Guidelines for research

We won't take legal action against good-faith research that follows these rules:

• Use only accounts you create yourself. Never access, change or delete other people's data; if you reach any by accident, stop, don't keep it, and tell us.
• Don't degrade the service: no denial-of-service, flooding, spam or automated scanning at high volume.
• No social engineering, phishing or physical attacks on our staff or vendors, and don't test Plaid, Stripe or other vendors' systems through us.
• Give us a reasonable time to fix the problem before telling anyone else.

We don't run a paid bug bounty yet, but we'll gladly credit you when a fix ships, if you'd like.

Machine-readable contact details: security.txt.