Security

Your Financial Data,
Protected.

Waypoint Budget uses bank-level encryption, trusted security partners, and strict access controls to keep your financial information safe. We never see your bank passwords, and we never sell your data.

Security at a Glance

Three pillars that protect every piece of your financial data

Bank-Level Encryption

All data is encrypted with SSL/TLS in transit and encrypted at rest. The same standards used by major financial institutions.

Zero Credential Storage

We never see or store your bank passwords. Bank connections go through Plaid or Flinks, and you authenticate directly with your bank.

Secure Infrastructure

Hosted on Vercel with automatic backups, DDoS protection, and edge network delivery worldwide.

PlaidFlinks

How Bank Sync Works

Powered by Plaid and Flinks — trusted by Venmo, Coinbase, Wealthsimple, and thousands of financial apps

The Provider Is the Intermediary

When you connect a bank, you log in through Plaid or Flinks's secure portal, not through Waypoint Budget. Your credentials go directly to the provider, and we never see them.

Read-Only Access

Waypoint Budget can only read transaction data. No one, including Plaid or Flinks, can move money, make transfers, or modify your accounts.

Trusted by 10,000+ Institutions

Plaid connects to over 10,000 institutions across the US and Canada. Flinks adds deeper Canadian coverage for the banks and credit unions Plaid can't reliably reach. Both maintain SOC 2 Type II compliance and regular security audits.

Revoke Access Anytime

You can disconnect any bank from Waypoint Budget at any time. You can also revoke Plaid or Flinks's access directly through your bank or the provider's portal.

Authentication & Payments

Industry-leading partners handle your login and payment security

Clerk

Authentication by Clerk

Clerk is an enterprise-grade authentication platform that handles your login securely. It is SOC 2 Type II compliant and supports multi-factor authentication.

  • SOC 2 Type II compliant
  • Multi-factor authentication support
  • Session management and device tracking
Stripe

Payments by Stripe

Stripe handles all payment processing. They are PCI DSS Level 1 certified, the highest level of security certification in the payments industry.

  • PCI DSS Level 1 certified
  • We never see or store your card number
  • Encrypted payment sessions

Data Privacy

Your data belongs to you. Period.

We Never Sell Your Data

Your financial data is never sold, shared with advertisers, or used for marketing purposes. We make money from subscriptions, not your data.

Export Your Data

You can export all your data at any time. Your budgets, transactions, and financial history are always accessible to you.

Delete Everything Anytime

You can delete your account and all associated data at any time. Once deleted, your data is permanently removed from our systems.

Full Privacy Policy

Read our complete privacy policy for details on how we collect, use, and protect your information. View privacy policy

Infrastructure Security

Built on trusted, modern infrastructure from the ground up

Hosted on Vercel

Waypoint Budget runs on Vercel's globally distributed infrastructure with automatic scaling, DDoS protection, and edge network delivery.

Encrypted PostgreSQL Database

All data is stored in PostgreSQL with encryption at rest. Regular automated backups ensure your data is never lost.

Regular Security Updates

Dependencies and infrastructure are kept up to date with the latest security patches. We monitor for vulnerabilities continuously.

HTTPS Everywhere

Every connection to Waypoint Budget is encrypted with HTTPS. We enforce strict transport security headers to prevent downgrade attacks.

Security FAQ

Where is my data stored?
Your budgets, transactions and goals are stored in Canada, in the Montreal region. They are encrypted at rest and in transit, covered by Canadian privacy law (PIPEDA and Quebec's Law 25), and kept on SOC 2 Type II certified infrastructure with automatic backups. Our app servers run in Montreal too, so Flinks connections go from your bank to our database without leaving Canada. Two things can take your financial data across the border: bank data from Plaid connections passes through Plaid's US infrastructure, and Money Coach messages may be processed by AI providers in the US. Privacy policy
Can Waypoint Budget move money or change my bank accounts?
No. Bank access is read-only. Waypoint Budget connects through Plaid and Flinks and can only view balances and transactions. No one can move money, make transfers, or modify your accounts through it. You can revoke access at any time.
What data does Waypoint Budget store?
Your transactions, categories, goals and preferences. Never your bank password or card number. Sign-in is handled by Clerk and payments by Stripe, so passwords and card numbers never touch our servers.
How do I delete my account and data?
From Profile, under Your Data, any time. Your budget data is removed permanently. Budgets, transactions, categories and goals are deleted from our database. Export anything you want to keep first, because this cannot be undone.
Is my payment information secure?
Yes. Payments run through Stripe, which is PCI DSS Level 1 certified. Waypoint Budget never sees or stores your card number. Website and Android subscriptions are processed by Stripe, and iPhone app purchases by Apple.
What happens if there is a data breach?
We would notify affected people as soon as possible and work to contain it. Because we do not store bank passwords or card numbers, the risk of financial credential exposure is much lower than it would be otherwise.

More questions answered on the FAQ page.

Start Budgeting with Confidence

Your financial data is protected by bank-level encryption, trusted security partners, and strict privacy controls. Free to start, no credit card required.

Get Started Free

No credit card required · Bank-level encryption · Delete your data anytime