Security
What actually protects a Buhata account, in the words of the code that does it. Everything on this page is a thing the server does, not a thing we intend to do.
Signing in
Connecting a bank requires a passkey. Your device asks for your fingerprint, face, or PIN, the credential is bound to buhata.com and cannot be phished onto a lookalike site, and the emailed code exists only to create that passkey or replace it when you change devices.
Passwords are hashed with scrypt, salted separately for every account, and carry a version marker so the work factor can be raised later without locking anybody out. Comparisons are constant-time, so a wrong password takes the same time to reject whatever it is wrong by.
Most people never set one. Signing in is a code sent to your address, or Google, Microsoft or Apple. Codes are single use, expire, and are rate limited.
Sessions
Every session is a row on our server, not a token we cannot take back. Signing out revokes it there, and so does deleting the device from Settings. Sessions carry an audience: a session made for the Help Center cannot read your app data, and a session made for the app cannot act as you in the Help Center. That separation is checked on every request rather than assumed at sign-in.
What the server refuses to do
Two rules are enforced in code rather than in policy, which means they hold whether or not anyone reads this page.
- Money never enters a shared document. Not a household, not a team, not on any plan, and no setting changes it.
- Health is held the same way. Weight, water, workouts and habits stay with you inside every Space you are part of.
Sharing a plan with another adult gives them the plan. It does not give them your entries, your balances or your history.
In transit and in the browser
Everything is HTTPS, with HSTS covering the domain and its subdomains, so a browser refuses to speak to us in plain text after the first visit. The site sends the headers that stop a page being framed, being sniffed, or leaking where you came from in a referrer. Links that hand you between our own pages are single use and cannot be spent from inside a frame.
How little we run
Most of what a product like this normally pulls in off the shelf is written here instead. That is slower to build and much smaller to attack, because every borrowed library is somebody else’s code running next to your data.
Deleting an account
Deletion is real and it cascades. Sessions, backups, devices, Space membership, subscriptions, notification subscriptions and anything else keyed to you are removed together, and the sweep runs on a schedule rather than when somebody remembers. A job application, if you ever sent one, is deleted with everything else and is separately deleted twelve months after you sent it whether you ask or not.
Who else touches your data
The app has to run somewhere, so a short list of companies keeps it running. The privacy policy names every one of them and says exactly what each receives. Nothing you write is sold, rented or handed to an advertiser.
Connecting a bank
Your bank username and password are typed on your bank’s own screen, through Plaid, and never reach Buhata. What comes back is the account name, the balance and the list of transactions. The key that reads them is stored encrypted, is never handed back out by any part of the app, and never appears in a log or in a support tool.
Buhata reads your account. It cannot move money, and it never asks for the details that would let it. Disconnect a bank and the transactions it brought in go with it.
What you can do yourself
Export everything you have, on any plan, whenever you want. Delete your account from Settings and watch it go at once, Restore Points included, so support can’t bring it back. The only copy that outlives it sits inside the encrypted backups of our whole database, which nobody can sign in to and which are never used to restore one account. Sign out a device you no longer have from any other device. The privacy policy lists every right you have over your information and how to use it.
Found a problem?
Write to security@buhata.com and a person reads it. We reply within two business days, tell you what we found within ten, and tell you when it is fixed. A report that could mean somebody’s data was exposed is escalated the same day.
If you research security for a living, the scope, the ground rules and our commitment to people who report in good faith are in our security policy and at /.well-known/security.txt.