Cake Budget
reference

Security & Privacy

How Cake Budget protects your financial data and respects your privacy

Last updated: October 10, 2025

Your financial data is sensitive. This guide explains exactly how Cake Budget protects your information and respects your privacy.

Core Security Principles

1. Read-Only Access

Cake Budget can NEVER move your money.

  • ✅ View transactions
  • ✅ View balances
  • ✅ View account names
  • ❌ Transfer funds
  • ❌ Initiate payments
  • ❌ Withdraw money
  • ❌ Change account settings

Why this matters: Even if our systems were compromised, attackers couldn’t steal money from your accounts.

2. No Credential Storage

Your bank passwords never touch our servers.

How login works:

  1. You click “Connect Bank”
  2. Plaid window opens (separate secure interface)
  3. You enter credentials directly into Plaid
  4. Plaid authenticates with your bank
  5. Plaid gives Cake Budget an access token
  6. Your credentials stay with Plaid

We never see or store:

  • ❌ Bank usernames
  • ❌ Bank passwords
  • ❌ Security questions
  • ❌ PINs

3. Bank-Level Encryption

All data is encrypted in transit and at rest.

In Transit:

  • HTTPS/TLS encryption for all API calls
  • 256-bit encryption keys
  • Secure websocket connections
  • Encrypted data transmission

At Rest:

  • Database encryption
  • Encrypted access tokens
  • Additional encryption for sensitive fields
  • Regular security audits

4. Trusted Third-Party Services

We use industry-standard providers:

Plaid: Bank connections

  • SOC 2 Type II certified
  • Used by 8,000+ financial apps
  • Bank-approved partnerships

Stripe: Payment processing

  • PCI DSS Level 1 certified
  • Your credit card data never touches our servers
  • Industry-leading payment security

What Data We Collect

Financial Data (via Plaid)

Automatically collected:

  • Transaction history (up to 2 years)
  • Account balances
  • Account names and types
  • Institution information

Never collected:

  • Full account numbers (only last 4 digits)
  • Bank passwords or credentials
  • Social Security Numbers
  • Account statements or documents

Account Data

What we store:

  • Email address
  • Name
  • Password (hashed with bcrypt, not plaintext)
  • Subscription status
  • User preferences (theme, notification settings)

Usage Data

Analytics collected:

  • Feature usage (which features you use)
  • Performance metrics
  • Error logs (sanitized)
  • Session data

Purpose: Improve the product, fix bugs, understand usage patterns.

Analytics provider: PostHog (privacy-focused analytics)

How We Use Your Data

What We Do

Use your data for:

  • ✅ Providing budgeting features
  • ✅ Transaction categorization
  • ✅ Funding schedule detection
  • ✅ AI insights generation (if enabled)
  • ✅ Product improvements
  • ✅ Customer support
  • ✅ Security monitoring
  • ✅ Service communications

What We DON’T Do

We never:

  • ❌ Sell your data to third parties
  • ❌ Use data for advertising
  • ❌ Share with credit bureaus
  • ❌ Provide data for lending decisions
  • ❌ Sell transaction lists to marketers
  • ❌ Use for any purpose outside budgeting

Third-Party Services

Services we use and why:

Plaid (Bank Connections)

  • Access: Transaction data, account balances
  • Purpose: Connect to your bank securely
  • Privacy: Plaid’s privacy policy applies
  • Security: SOC 2 Type II certified

Stripe (Payments)

  • Access: Payment method, billing info
  • Purpose: Process subscription payments
  • Privacy: Credit card data never touches our servers
  • Security: PCI DSS Level 1 certified

OpenAI (AI Insights)

  • Access: Anonymized transaction patterns
  • Purpose: Generate spending insights
  • Privacy: No personally identifiable information sent
  • Security: Only aggregated, anonymized data

Sentry (Error Monitoring)

  • Access: Error logs, stack traces (sanitized)
  • Purpose: Catch and fix bugs
  • Privacy: Sensitive data filtered before sending
  • Security: Minimal data exposure

PostHog (Analytics)

  • Access: Feature usage, page views
  • Purpose: Understand product usage
  • Privacy: Privacy-focused, no cross-site tracking
  • Security: Self-hosted option for data control

Resend (Email Delivery)

  • Access: Email addresses, email content
  • Purpose: Deliver transactional and notification emails
  • Privacy: No data sharing with third parties
  • Security: Encrypted transmission

Data Retention & Deletion

Active Accounts

While subscribed:

  • Transactions stored indefinitely for historical tracking
  • Account balances updated continuously
  • All data accessible

After Subscription Ends

When subscription lapses:

  • Syncing stops
  • Historical data preserved for 90 days
  • Resubscribe to restore access
  • After 90 days: Data may be archived

Account Deletion

When you delete your account:

  • Immediate: All bank connections revoked
  • Within 7 days: Access to data removed
  • Within 30 days: All data permanently deleted
  • Within 90 days: Deleted from backups

How to delete: Settings → Account → Delete Account → Confirm

This is permanent and irreversible.

Password & Authentication Security

Password Requirements

Minimum standards:

  • At least 8 characters
  • Mix of letters, numbers, and symbols recommended
  • Checked against known compromised password databases

Best practices:

  • Use unique password (not used elsewhere)
  • Use password manager
  • Never share your password

Password Storage

How we store passwords:

  • Hashed using bcrypt (industry standard)
  • Never stored in plaintext
  • Can’t be reversed to original password
  • Even we can’t see your password

Session Security

Automatic protection:

  • Sessions expire after 30 days of inactivity
  • Re-authentication required after expiration
  • Secure session cookies (HTTP-only, secure flag)

Manual control:

  • Log out from any device
  • Revoke all sessions in Settings

Email & Communication Privacy

Emails We Send

Transactional (required):

  • Welcome email
  • Subscription confirmations
  • Payment receipts
  • Bank connection issues
  • Security alerts

Optional (can opt out):

  • Funding schedule notifications
  • Rule execution summaries
  • Weekly insights
  • Feature announcements

Unsubscribe: Click “Unsubscribe” in any email or manage in Settings → Notifications.

We Never

  • ❌ Sell your email address
  • ❌ Send spam
  • ❌ Share with marketers
  • ❌ Send unsolicited promotions

Data Access Rights

Your Rights

You have the right to:

  • Access: Request a copy of your data
  • Correct: Update inaccurate information
  • Delete: Request complete data deletion
  • Port: Export your data
  • Object: Opt out of certain processing

How to exercise rights: Email support@trycakebudget.com with your request.

Internal Access Controls

Who can access your data:

  • Support team: Only when you request help
  • Developers: Sanitized logs during debugging (no sensitive data)
  • System administrators: Maintenance and security monitoring

Access controls:

  • Need-to-know basis only
  • Audit logs of all data access
  • Role-based permissions
  • Regular access reviews

Security Best Practices for Users

Protect Your Cake Budget Account

Do:

  • ✅ Use a strong, unique password
  • ✅ Log out on shared devices
  • ✅ Review connected banks regularly
  • ✅ Keep email secure (password reset vector)

Don’t:

  • ❌ Share your password
  • ❌ Use the same password as other sites
  • ❌ Leave sessions open on public computers
  • ❌ Ignore security notifications

Protect Your Bank Account

Do:

  • ✅ Use strong bank passwords
  • ✅ Enable MFA at your bank
  • ✅ Monitor bank account activity
  • ✅ Update expired Plaid connections promptly

Don’t:

  • ❌ Ignore connection expiration notices
  • ❌ Share bank credentials with anyone

Recognize Phishing

Cake Budget will NEVER:

  • ❌ Email asking for your password
  • ❌ Request bank credentials via email
  • ❌ Ask for sensitive info over email
  • ❌ Send suspicious links requesting login

If you receive a suspicious email:

Incident Response

If You Suspect Unauthorized Access

Immediate steps:

  1. Change your password: Settings → Account → Change Password
  2. Log out all sessions: Settings → Account → Security
  3. Review recent activity: Check for suspicious transactions
  4. Contact support: Email support@trycakebudget.com
  5. Contact your bank: If you see unauthorized bank activity

Our Response to Security Incidents

Our commitment:

  • Immediate investigation
  • Email notification to affected users
  • Clear explanation of what happened
  • Steps to protect your account
  • Remediation and prevention measures

Timeline:

  • Notification within 72 hours of discovery
  • Ongoing updates until resolved
  • Post-mortem analysis shared

Compliance

Cake Budget complies with:

  • GDPR (General Data Protection Regulation)
  • CCPA (California Consumer Privacy Act)
  • Industry security best practices
  • Financial data handling regulations

Reporting Security Issues

Found a security vulnerability?

Please report responsibly:

We take security seriously and appreciate responsible disclosure.

Questions About Security or Privacy?

Contact us:

Read our full policies:

  • Privacy Policy: trycakebudget.com/privacy
  • Terms of Service: trycakebudget.com/terms

Bottom Line: We take security seriously. Your financial data is protected with industry-leading encryption, read-only access, and strict privacy controls. You control your data, always.

30-Day Trial No CC required