Headcount plans, vendor terms, runway. We treat that data the way you would — isolated at the database layer, tested adversarially, and provable rather than promised.
100%
of database tables protected by row-level security
100+
live authorization checks run as real users
Continuous
automated monitoring of our security controls
The question every finance team should ask a shared platform: what actually stops another customer — or a bug — from reaching my numbers? Here, three independent layers.
Every tenant table carries your organization's id, and every one of them, with zero exceptions, is protected by PostgreSQL row-level security. The database itself refuses cross-tenant reads and writes, so isolation doesn't depend on application code getting every query right. The UI is presentation; the database is the boundary.
An adversarial test suite signs in as real users of different organizations and roles and actively attempts cross-tenant access — reading another org's budgets, writing forecasts into branches it doesn't own, forging approvals, escalating roles. More than a hundred of these live authorization checks run against a real database on changes to the access model.
Isolation isn't only between companies. Five roles (owner, admin, FP&A, member, viewer), branch-level delegation so a budget owner sees and edits only their branch, allocation targets visible only to the people they're for, and an approval gate for sign-offs. Access is scoped to the work, not the org chart.
TLS for every connection in transit; AES-256 encryption at rest on our database infrastructure. Strict transport security (HSTS), content-type protections, and clickjacking denial are enforced — and verified by an automated check on every single deploy.
Automatic nightly snapshots of every budget, a full named-version history, and restore that has been exercised — including the details: private bookmarks, co-ownership, and system markers survive a restore intact.
Full-fidelity Excel export of any budget at any time, plus downloadable backups. No export tax, no lock-in — being easy to leave is part of being trustworthy to stay with.
An organization audit log for administrative actions and a per-budget change log for every edit — who, what, when, and what it replaced — with one-click revert. Accrual inputs keep a full input history, including edits made through spreadsheet uploads.
Errors are monitored with automatic scrubbing so budget figures and personal data don't leak into diagnostics. Automated compliance monitoring continuously tests our infrastructure controls and flags drift — not once a year before a renewal. Direct database connections from the internet are blocked: the app reaches the database only through Supabase's HTTPS APIs, where row-level security applies to every request.
Everything we send comes from bucketize.org with SPF, DKIM, and DMARC verified — the emails your team gets from us are hard to spoof.
Served at the edge by Cloudflare; data lives in PostgreSQL managed by Supabase on AWS. Credentials and API keys live in a managed secrets vault — never in code, never in the client.
If your policies require physical isolation or data residency, enterprise plans can run on a fully dedicated instance — your own database, same product, migrated and backed up on the same tooling as everyone else's.
We take reports seriously and respond fast. Email security@bucketize.org or use Report a problem in the app — it reaches us with the context attached.
Vulnerability disclosure policy
We don't run a paid bug bounty. Machine-readable contact details are at /.well-known/security.txt.
Every claim on this page is verifiable in our codebase and running product. We don't list certifications we don't hold — and we'll update this page the day that changes.