How we keep your books safe
Your sales, spending and customers' details are private. Here's what protects them, in plain English, and what you can do too.
Encrypted on the way and at rest
Every page and every request uses an encrypted connection (HTTPS), and browsers are told never to use an unencrypted one. Your books are stored with Supabase, our database provider, on encrypted disks.
Each company's books are walled off
Who can see which records is enforced by rules inside the database itself, not only by the app's screens. A request for another company's records gets nothing back, even if someone built the request by hand. We test these rules before every update.
People see only what their job needs
- Owners see everything in their company and are the only ones who can delete.
- Employees see the screens you allow. They never see your profit or what things cost you.
- Accountants you invite can read your books and download reports, and can't change anything.
- Household members of a shared budget see that budget and nothing of yours outside it.
You can remove someone from Team or Household at any time, and they lose access right away.
Receipts and invoices
Receipt photos are stored privately. To show one, the app asks for a link that stops working after an hour. Invoice links are long and random, show only that one invoice, and never include your costs.
Read on your device
Some things never leave your phone or computer. When you read a receipt photo, the text is picked out in your browser. When you import a bank statement, the file is read in your browser and only the rows you keep are saved. When you scan a driver's license to add a customer, only the name and address are kept, never the license number or birth date.
No bank logins
BuckLoad never asks for your bank username or password, and doesn't connect to your bank. You bring in a file you downloaded yourself.
Your password, and a second step
Passwords are handled by our sign-in provider and stored only as a secure hash, so nobody at BuckLoad can see yours. You can also sign in with Google.
Turn on two-step login from your account menu and signing in also needs a 6-digit code from an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, 1Password and others). It's enforced by the database itself: until the code is typed, your books can't be read or changed, even with your password.
About business passcodes. A passcode on a business hides it on a shared computer until someone types it. It's a privacy screen, not a lock: anyone signed in to your account could still reach those books. For real protection, keep your own login to yourself and give staff their own.
Your data, your call
Download everything you've entered at any time: click your name, then Download my data. Delete your account the same way, with Delete my account. When an owner deletes a company or budget, its records and receipt files are deleted. Copies in our providers' backups are removed on their normal schedule, usually within 30 days.
What we don't claim
BuckLoad doesn't have an outside security certification such as SOC 2. We'll say so here if that changes. No system is perfectly secure, so use a strong password you don't use anywhere else.
Found a problem?
If you think you've found a security issue, email us through the Help page with the details. Please don't test against other people's accounts. Read our privacy policy for what we collect and who processes it.