Security
Placeholder notice describing the controls implemented in the software today. It is not a compliance attestation, and BuyerPass holds no third-party certifications.
Credentials
BuyerPass never receives institution usernames or passwords. Those are entered inside Plaid’s own interface. The access token Plaid returns is stored server-side only: it is never sent to a browser, never returned by an API route, never written to logs, and is excluded at the column level from the database role that buyer-facing pages use.
Authorization
Every protected route checks the session server-side before rendering. Buyer-facing database queries additionally run under PostgreSQL Row Level Security as a restricted role, so a query that forgot its ownership filter would still return nothing.
Verification links
Link tokens are generated from a cryptographically secure random source and carry roughly seventy bits of entropy, which makes guessing a live link impractical. Verification pages are excluded from search indexing, are rate limited, and can be revoked or allowed to expire by the account holder.
Bank access
BuyerPass never receives institution credentials: they are entered inside Plaid’s own interface. The access token Plaid returns is used to read balances and holdings and is then revoked within the same request, so no bank access token is stored at any point. A compromise of the BuyerPass database cannot yield access to anyone’s accounts.
Personal data
BuyerPass performs no government-ID check, so it holds no identity documents and no biometric data. The name it stores is the one the account holder typed for display.
Payments
Card details are handled entirely by Stripe Checkout and never reach BuyerPass. Incoming Stripe webhooks are rejected unless their signature validates against the endpoint secret.
Known limitations of this build
- Rate limiting is in-process and therefore per-instance.
- There is no audit log, no key rotation process and no intrusion detection.
- Plaid access tokens are stored without an additional application-layer encryption key.
- No penetration test or third-party security review has been performed.