Security

How we protect your data.

planbend holds the financial picture you build — so security isn't a feature, it's the foundation. This page describes, in plain language, how your data is stored, encrypted, isolated, and deleted, and how to reach us if you find a problem.

This page reflects current practices and may be updated over time. Last updated: June 2026.

Infrastructure

planbend runs on managed cloud infrastructure: Supabase for the database and authentication, and Vercel for application hosting and delivery. Both are established providers whose platforms carry industry certifications such as SOC 2. These certifications cover the underlying platforms rather than planbend itself. We run automated backups and periodically test our restore process.

Encryption

Connections to planbend use HTTPS with TLS, so your data is encrypted in transit between your browser and our servers. Your plan data stored in Supabase is encrypted at rest using AES-256. We never store your password — authentication is handled by Supabase, which stores only a one-way hash.

Access and data isolation

Row-level security. Every user can read and write only their own data. This is enforced at the database layer by row-level security policies — not just in application code — so even in the unlikely event of an application bug, the database itself prevents one user from seeing another's data.
Authenticated requests. Server operations that touch your data require a valid authenticated session.
Internal access. Administrative access on our side is limited to authorized personnel and used only for operating the service and responding to support requests. We do not browse individual plan data.

Application security

Content Security Policy. A strict CSP and a set of companion security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) are enforced on every route to reduce cross-site scripting and clickjacking risk.
No bank connections. planbend does not link to your bank or brokerage. We never see live account credentials or transactions — only the figures you choose to enter. That deliberately keeps the most sensitive category of data out of the product entirely.
Minimal data. We don't collect SSNs, full account numbers, or government IDs. Less collected means less to protect.

Payments

Subscriptions are processed by Stripe, a PCI DSS Level 1 certified payment provider. Your card details are entered directly with Stripe and are never stored on planbend's systems — we receive only a token and the billing status needed to manage your subscription.

Your control over your data

Export anytime. Download your complete plan as JSON from Settings → Backup Data.
Delete anytime. Settings → Delete my account data removes your plan and profile from our systems. We auto-export a backup for you first. Certain records (such as billing history) may be retained where required for tax or legal purposes.
Edit anytime. All of your data is editable directly in the app, so corrections are immediate.

Incident handling

If we discover unauthorized access to personal information on our systems, we will investigate, take appropriate action to contain and remediate it, and notify affected users as required by applicable law. We treat this as an obligation, not a courtesy.

Reporting a vulnerability

We do not currently run a paid bug-bounty program, and this page does not authorize testing against our production systems or other users' data. If you discover a security issue, please report it responsibly by emailing security@planbend.com with enough detail for us to reproduce and investigate. We appreciate good-faith reports and will respond.

A note on certifications

planbend is an independent, bootstrapped product. We build on certified infrastructure (Supabase, Vercel, Stripe), but planbend itself does not yet hold its own SOC 2 attestation. A formal SOC 2 process is a milestone we intend to pursue as we grow, and we will update this page when it begins. We'd rather state that plainly than imply a certification we don't hold.

Contact

Planbend LLC · Toano, Virginia