Security
HomeBasisLedger holds a record of your home and what you have spent on it — personal financial information you may not touch again for years, and will most need the day you sell. Keeping it safe is the whole point, so here is plainly how we do it. We describe how the app is built, not secrets that would help anyone get in.
Who can see your records
Every account’s data is walled off from every other customer’s at the database itself, using row-level security — not merely hidden by the app. A request for your homes or improvements returns your rows and no other customer’s, even if a bug elsewhere asked for more. The rule lives one layer below the code, where it can’t be sidestepped by a mistake in a screen or a link.
There are two exceptions, and you should know about both:
- The partner who sponsors your account, if you have one — the realtor, lender or tax professional who gave you the account. They can see the improvements you log, including the description, the amount and the date, so they can help you keep the record complete and ready for the day you sell. You can always see who your sponsor is in the app. They cannot see your receipt files.
- Our own staff, who can look at account records to answer a support question or fix a problem. They cannot see your receipt files either.
No other customer can see any of it, and nobody outside those two groups can reach your receipt files at all.
Encrypted in transit and at rest
Everything you send to and from the site travels over HTTPS, so it can’t be read in transit. Your data is then held by a managed database that encrypts it at rest, so the stored copy is encrypted too.
Your receipts stay private
Receipt photos and invoices are kept in private storage — never on a public address anyone could stumble onto. When you open one, the app mints a temporary link that expires about an hour later, so a copied URL isn’t a lasting key to your file.
Sign-in and passwords
You sign in with your email address and a password, or with your Google account. If you use a password, it is stored only in hashed form by our authentication provider — we never see it and can’t recover it; we can only email you a link to set a new one. If you use Google, we never see your Google password at all.
Payments
Card payments are handled entirely by Stripe, a certified payments provider. Your card number is entered on Stripe’s side and never touches our servers — we keep only a reference that lets us show your plan and open your billing portal.
Deleting your data
Your record is yours to take back. Deleting your account removes your profile and, with it, your homes, improvements, and stored receipts. You’re never locked in — and before you go, Pro accounts can export a complete copy for their own files or their tax professional.
Reporting a concern
Security is never “finished,” and a second set of eyes is welcome. If you believe you’ve found a vulnerability or something that doesn’t look right, please tell us before sharing it publicly, and we’ll look into it promptly.
- Email info@homebasisledger.com with what you found and how to reproduce it.
- Please don’t access or change data that isn’t yours, or run tests that could disrupt the service for others.
This page describes our practices in good faith and will change as the product does; it isn’t a contract or a warranty. Nothing here is tax advice — HomeBasisLedger provides recordkeeping tools.