Practical controls, accurately described.

Authentication and authorization

• Authenticated API routes validate signed access tokens.
• Refresh tokens support rotation and revocation.
• Resource access checks scope records to the user or active household relationship.
• The separate Admin surface uses role-based permissions and audit logs.

Server-side access controls

Subscription eligibility and access permissions are enforced on authenticated API routes. Navigation and deep links are checked too, but the server remains the authorization boundary.

Data protection

The application uses AES-256-GCM field-level encryption for specific fields in its encryption registry: user email and name, transaction notes, account notes, and selected institution identifiers. Email lookup uses a separate keyed HMAC blind index.

This is intentionally a limited claim. Other structured budgeting fields are protected by database, network, access-control, and operational safeguards but are not all encrypted at the application-field layer.

Payment data

The payment provider shown at checkout acts as Merchant of Record and handles payment collection. befinely receives subscription and order or transaction metadata needed to provision access but does not receive or store full payment card numbers.

Secure development

• Input schemas validate API payloads.
• Central error handling avoids returning internal implementation details.
• Administrative access and changes are recorded in audit logs.
• Database schema changes use versioned migrations.
• Automated type checks, linting, tests, and build verification run before release.

Responsible disclosure

We welcome good-faith reports. Do not perform denial-of-service testing, social engineering, destructive testing, automated scanning that degrades service, or testing on another person's account. We will acknowledge a complete report and prioritize it based on impact.