Data Security
This page sums up how Budgetku protects your financial data. It lists only what already works in the app today. What data we collect, why, and how long we keep it is set out in the Privacy Policy.
Each workspace is separated at the database level
Financial records are stored per workspace, and the separation is enforced by the database itself through Postgres Row-Level Security, not only by application code. The app connects to the database with a role that cannot bypass these rules, and every request can only read the rows of the workspace that is open. If a query in the code forgets to filter by workspace, the database still returns no other workspace's data. Members you invite to a workspace can see all of its contents, and the role you give them decides what they may change. An invoice you share through a public link can be opened by anyone who has the link.
Connections always use HTTPS
Every Budgetku page and its API are served over HTTPS only, so the data you send is encrypted in transit. Requests over http are redirected to https automatically, and an HSTS header tells your browser to always use HTTPS for budgetku.com.
Passwords are stored as Argon2id hashes
Your password is not stored as you typed it. What is stored is an Argon2id hash, made with a random salt that is different for every password.
Sign in with Google
You can sign up and sign in with a Google account without creating a password for Budgetku. Signing in with Google does not give us access to your Gmail, Drive, or contacts. The data we receive from Google is described in the Privacy Policy.
Download your data at any time
On every plan, Free included, you can download a copy of your data yourself from the profile menu (top right) → Account → Download my data, without asking us. You get one ZIP file with your account data, plus the accounts, categories, transactions, budgets, customers, invoices, and tags of every workspace you own. The Pro and Business plans can also export transactions and reports to CSV.
Delete your account at any time
You can delete your account yourself from the profile menu (top right) → Account → Delete account, confirming with your password. If you cannot sign in, or your account has no password because it only uses Sign in with Google, request deletion by email at support@budgetku.com. What happens to your account and workspace data afterwards is explained on the Account Deletion page.
Your rights under the PDP Law
As the owner of your personal data, you have rights under Indonesia's Personal Data Protection Law (Law No. 27 of 2022), including to access and download your data, correct inaccurate data, request account deletion, and withdraw consent. How to exercise these rights in Budgetku is explained in the Privacy Policy.
Reporting a security issue
If you notice suspicious activity on your account or find a security vulnerability, email support@budgetku.com. No system is 100% secure, so please keep your password confidential too.