Security & compliance

• In transit: TLS on everything. HTTPS is enforced on the production domain, the database connection is TLS, and every third-party API call is HTTPS.
• At rest: AES-256 at the database platform level, the standard treatment for managed Postgres.
• A second layer on the sensitive fields: HMRC OAuth tokens and National Insurance numbers are encrypted again at the application level before they are written, using a key held only in server environment variables and never stored in the database. Someone holding a copy of the database alone could not read them.
• Card details: never touch our servers at all. Payment happens on Stripe's own hosted checkout.

Every table in the database has row-level security enabled, with no exceptions — the rule that scopes data to your account is enforced by the database itself, not by application code that could be bypassed by a bug in a single query. The tables holding HMRC OAuth tokens, rate-limit records and Stripe webhook events go further and have no client-facing access policies at all: only server-side code running with the service role can read them.

Team access is scoped per property, not per account. Giving your accountant access to one flat gives them that flat, with a viewer or editor role, and nothing else.

LetBuddy does not connect to your bank, and that is a design decision rather than a missing feature. There is no Open Banking integration, no bank credentials are ever entered here, and nothing about your account is polled in the background. Bank data arrives one way only: you export a statement from your own online banking and upload the file. LetBuddy then suggests which lines look like rent received or a deductible expense, and you approve each one before it is saved.

What that buys you is control. Nobody holds standing read access to your current account, there is no permanent connection sitting there to be revoked, breached, or quietly widened later, and nothing reaches LetBuddy that you did not choose to send it. In practice it is one upload when you sit down to do your expenses, and your account stays entirely your own in between.

It also keeps LetBuddy outside the FCA's regulatory perimeter. Holding a live feed would make a provider an account information service; because LetBuddy neither initiates payments nor accesses accounts, no FCA authorisation is required for what it does. If we ever add a live feed, we will say so here first, along with whose permission it runs under.

• Official API only. Submissions go through HMRC's published Making Tax Digital API. Nothing is scraped, and no unofficial route is used.
• We never see your Government Gateway login. Authorisation happens on HMRC's own hosted sign-in page using OAuth 2.0 with PKCE. LetBuddy only ever receives a token, and that token is encrypted before storage.
• Digital links. Your records stay digital from entry to submission. A figure typed in, imported from a spreadsheet, or matched from an uploaded statement flows into the quarterly total by calculation, not by being manually re-keyed into a submission form. There is no copy-and-paste step anywhere in the chain, which is the substance of HMRC's digital link requirement.
• Fraud prevention headers. HMRC requires software to send a set of headers identifying the device and connection method on every call. LetBuddy sends them on every real request, and where a header is genuinely uncollectable for a server-side web application, that omission has been put to HMRC's software developer support team in writing rather than faked.

The full legal basis for each transfer is in the privacy policy.

There is a written breach response procedure with a named contact, a defined containment sequence, and the actual reporting routes to the ICO and, where tax data is involved, to HMRC. The UK GDPR clock is 72 hours from becoming aware of a reportable breach, and it is treated as starting from awareness, not from convenience. Affected landlords are told directly where the breach is likely to present a high risk to them.

To report a vulnerability, email hello@letbuddy.co.uk with “security” in the subject. Good-faith reports are welcomed and will not be met with legal threats. There is no bug bounty budget — what there is, is a reply from the people who wrote the code, rather than a ticket number.