Security & compliance
If you're about to put every tenancy, certificate and tax figure you own into a piece of software, you should get more than the phrase “bank-level security.” This page is the specific version: what is encrypted and how, where it sits, who else touches it, how that is checked, and what happens if something goes wrong.
Zero bank access
No Open Banking and no bank credentials. You upload a statement; you approve each line.
EEA data hosting
Database and server code in Stockholm.
AES-256 and TLS
Encrypted at rest with AES-256, and in transit with TLS.
Row-level security
Every table, no exceptions. The database enforces who sees what.
The detail: encryption, access control and bank dataShow less
Encryption
- In transit: TLS on everything. HTTPS is enforced on the production domain, the database connection is TLS, and every third-party API call is HTTPS.
- At rest: AES-256 at the database platform level, the standard treatment for managed Postgres.
- Card details: never touch our servers at all. Payment happens on Stripe's own hosted checkout.
Access control
Every table in the database has row-level security enabled, with no exceptions. The rule that limits data to your account is enforced by the database itself, not by application code that a bug in one query could bypass. The tables holding rate-limit records and Stripe webhook events have no client-facing access policies at all. Only server-side code with the service role can read them.
Team access is scoped per property, not per account. Giving your accountant access to one flat gives them that flat, with a viewer or editor role, and nothing else.
Bank data — and why we do not need FCA authorisation
LetBuddy doesn't connect to your bank. That's a design decision, not a missing feature. There's no Open Banking integration, no bank credentials are entered here, and nothing about your account is polled in the background. Bank data arrives one way: you export a statement from your own online banking and upload the file. LetBuddy suggests which lines look like rent received or a deductible expense, and you approve each one before it's saved.
Nobody holds standing read access to your current account, there's no permanent connection to be revoked, breached or widened later, and nothing reaches LetBuddy that you didn't choose to send. In practice it's one upload when you sit down to do your expenses.
It also keeps LetBuddy outside the FCA's regulatory perimeter. A live feed would make a provider an account information service. LetBuddy neither initiates payments nor accesses accounts, so no FCA authorisation is required. If we ever add a live feed, we'll say so here first, along with whose permission it runs under.
Where your data sits, and who else touches it
| Provider | What it handles | Where |
|---|---|---|
| Supabase | Database and authentication | EEA — Stockholm, Sweden |
| Cloudflare | Network in front of the website — receives each request first and passes it to Vercel | Nearest edge location. Cloudflare, Inc. is a US company, so the UK Extension to the EU-U.S. Data Privacy Framework is the safeguard we rely on |
| Vercel | Application hosting and server-side compute | EEA — Stockholm, Sweden, for all server-side code. Routing happens at the nearest edge location, and Vercel Inc. is a US company, so the UK Extension to the EU-U.S. Data Privacy Framework is the safeguard we rely on |
| GitHub | Stores our nightly backups, encrypted before they leave our systems with a key GitHub does not hold. Deleted automatically after 90 days | United States, under its own transfer safeguards |
| Stripe | Subscription payments. Card details never reach our servers | United States / EEA, under Stripe's own transfer safeguards |
| Resend | Transactional email — reminders and alerts | United States, under its own transfer safeguards |
| Anthropic | Three optional AI features: reading uploaded certificates, drafting trade quote emails, triaging tenant reports | United States, under its own transfer safeguards |
| One optional lookup: searching for local trades on a maintenance job. Receives the trade and the property's postcode, nothing else | United States, under its own transfer safeguards |
The full legal basis for each transfer is in the privacy policy.
If something goes wrong
There's a written breach response procedure with a named contact, a containment sequence, and the reporting routes to the ICO and, where tax data is involved, to HMRC. The UK GDPR clock is 72 hours from becoming aware of a reportable breach, and it starts from awareness. Affected landlords are told directly where the breach is likely to present a high risk to them.
To report a vulnerability, email hello@letbuddy.co.uk with “security” in the subject. Good-faith reports are welcome and won't be met with legal threats. You get a reply from the people who wrote the code.
How it's kept that way
- Scanned every week. An OWASP ZAP scan runs against the live site on a schedule, and the shipped dependencies are audited against published advisories at the same time. A finding fails the run, and every report is kept. Fixes to dependencies arrive as pull requests the same week the advisory does.
- Every change is checked before it lands. Code cannot be pushed to the production branch until it typechecks and passes lint, and the same checks run again on the server as the record. Production access is held under least privilege by a named administrator, and every production action is logged.
- Headers the browser enforces. A per-request, nonce-based Content Security Policy so only scripts this server emitted can run; HTTPS pinned for a year; framing by other sites refused; the camera, microphone, location and payment APIs switched off for the whole site.
- Backed up nightly, restores rehearsed. The database, the authentication records and every uploaded document are backed up each night, encrypted before they leave our systems, and kept for 90 days. The restore procedure is exercised against a separate target, not just written down.
- Written down and reviewed. A dated information security policy and a breach response procedure, each with a named owner, reviewed on a schedule rather than when something goes wrong.
Last reviewed 14 September 2026. Questions about anything on this page can go to hello@letbuddy.co.uk and will get an answer.