Trust & Security
How we protect your money data
This page is maintained by the BantuMoneyT team to answer common security and privacy questions about the app. It describes the controls currently enabled in our application. It is not an independent certification or audit.
Authentication & access
- Sign-in with email/password or Google.
- Sessions are scoped per user; private screens require a valid session.
- Premium features are gated server-side.
Data isolation
- Every user-owned table (transactions, accounts, budgets, goals, bills, tontines, shopping lists, etc.) enforces row-level access rules so a user can only read or write their own rows.
- Privileged operations run only on the server, never trusted from the client.
- Expense-report status transitions are validated server-side to prevent self-approval.
Data in transit & at rest
- All traffic between your device and our backend uses HTTPS/TLS.
- Receipts you upload are stored in a private bucket, served via short-lived links.
- Secrets and API keys are kept server-side and never bundled into the client app.
Data you give us
- Account info (email, display name) and the financial entries you create.
- Optional receipt images you upload for AI scanning.
- You can delete entries at any time from inside the app.
Reporting a security issue
If you believe you have found a vulnerability, email security@bantumoneyt.online with steps to reproduce, and please don’t test against other users’ accounts.
Last updated: September 2026. This page is provided for information and does not constitute legal, compliance, or certification advice.