Headcount plans, vendor terms, runway. We treat that data the way you would — isolated at the database layer, tested adversarially, and provable rather than promised.
35 / 35
tables protected by row-level security — zero exceptions
100+
live authorization checks run as real users
Daily
automated SOC 2-aligned control audit
The question every finance team should ask a shared platform: what actually stops another customer — or a bug — from reaching my numbers? Here, three independent layers.
Every tenant table carries your organization's id, and every one of them — 35 of 35, zero exceptions — is protected by PostgreSQL row-level security. The database itself refuses cross-tenant reads and writes, so isolation doesn't depend on application code getting every query right. The UI is presentation; the database is the boundary.
An adversarial test suite signs in as real users of different organizations and roles and actively attempts cross-tenant access — reading another org's budgets, writing forecasts into branches it doesn't own, forging approvals, escalating roles. More than a hundred of these live authorization checks run against a real database on changes to the access model.
Isolation isn't only between companies. Five roles (owner, admin, FP&A, member, viewer), branch-level delegation so a budget owner sees and edits only their branch, allocation targets visible only to the people they're for, and an approval gate for sign-offs. Access is scoped to the work, not the org chart.
TLS for every connection in transit; AES-256 encryption at rest on our database infrastructure. Strict transport security (HSTS), content-type protections, and clickjacking denial are enforced — and verified by an automated check on every single deploy.
Automatic nightly snapshots of every budget, a full named-version history, and restore that has been exercised — including the details: private bookmarks, co-ownership, and system markers survive a restore intact.
Full-fidelity Excel export of any budget at any time, plus downloadable backups. No export tax, no lock-in — being easy to leave is part of being trustworthy to stay with.
An organization audit log for administrative actions and a per-budget change log for every edit — who, what, when, and what it replaced — with one-click revert. Accrual inputs keep a full input history, including edits made through spreadsheet uploads.
Errors are monitored with automatic scrubbing so budget figures and personal data don't leak into diagnostics. A daily automated audit runs our SOC 2-aligned control checks and reports drift — every day, not once a year before a renewal.
Everything we send comes from bucketize.org with SPF, DKIM, and DMARC verified — the emails your team gets from us are hard to spoof.
Served at the edge by Cloudflare; data lives in PostgreSQL managed by Supabase on AWS. Credentials and API keys live in a managed secrets vault — never in code, never in the client.
If your policies require physical isolation or data residency, enterprise plans can run on a fully dedicated instance — your own database, same product, migrated and backed up on the same tooling as everyone else's.
We take reports seriously and respond fast. Email security@bucketize.org or use Report a problem in the app — it reaches us with the context attached.
Every claim on this page is verifiable in our codebase and running product. We don't list certifications we don't hold — and we'll update this page the day that changes.