Security
HomeBasisLedger holds a record of your home and what you have spent on it — personal financial information you may not touch again for years, and will most need the day you sell. Keeping it safe is the whole point, so here is plainly how we do it. We describe how the app is built, not secrets that would help anyone get in.
Only you can see your records
Every account’s data is walled off from every other account’s at the database itself, using row-level security — not merely hidden by the app. In practice that means a request for your homes, improvements, or receipts returns your rows and no one else’s, even if a bug elsewhere asked for more. The rule lives one layer below the code, where it can’t be sidestepped by a mistake in a screen or a link.
Encrypted in transit and at rest
Everything you send to and from the site travels over HTTPS, so it can’t be read in transit. Your data is then held by a managed database that encrypts it at rest, so the stored copy is encrypted too.
Your receipts stay private
Receipt photos and invoices are kept in private storage — never on a public address anyone could stumble onto. When you open one, the app mints a short-lived link that works for a few minutes and then expires, so a copied URL isn’t a lasting key to your file.
Sign-in and passwords
You sign in with a secure email link, a password, or your Google account. If you use a password, it is stored only in hashed form by our authentication provider — we never see it and can’t recover it, we can only help you reset it. If you use Google, we never see your Google password at all.
Payments
Card payments are handled entirely by Stripe, a certified payments provider. Your card number is entered on Stripe’s side and never touches our servers — we keep only a reference that lets us show your plan and open your billing portal.
Deleting your data
Your record is yours to take back. Deleting your account removes your profile and, with it, your homes, improvements, and stored receipts. You’re never locked in — and before you go, Pro accounts can export a complete copy for their own files or their tax professional.
Reporting a concern
Security is never “finished,” and a second set of eyes is welcome. If you believe you’ve found a vulnerability or something that doesn’t look right, please tell us before sharing it publicly, and we’ll look into it promptly.
- Email info@homebasisledger.com with what you found and how to reproduce it.
- Please don’t access or change data that isn’t yours, or run tests that could disrupt the service for others.
This page describes our practices in good faith and will change as the product does; it isn’t a contract or a warranty. Nothing here is tax advice — HomeBasisLedger provides recordkeeping tools.