Trust & Security
Trust Center
Bao handles money. Here's exactly how we protect it.
- We read transactions onlyBao collects your transactions, never your account or routing numbers.
- Encrypted in transit and at restYour data is encrypted in transit and in our database, and our most sensitive secrets get an extra layer of our own.
- Multi-factor authenticationAn extra layer of protection on your account and on important actions.
- Anonymized categorizationMerchant-categorization improvements use anonymized, grouped data. No individual’s spending is ever exposed.
The detail
What we do today. We update this page as our systems change; our Privacy Policy states what we commit to.
Encryption
- All traffic between your device and Bao is encrypted in transit with TLS, and our website only accepts encrypted connections.
- Your data is encrypted at rest.
- Our most sensitive secrets, including the bank connection tokens we hold on your behalf and your multi-factor authentication secret, get an additional layer of encryption that we apply ourselves, with keys we rotate.
Bank connections
- You sign in to your bank through Quiltt, our bank data aggregator. We never see, receive, or store your bank username, password, or one-time codes.
- Our access is read-only. We cannot initiate transfers, make payments, or move money.
Signing in
- Multi-factor authentication with authenticator-app codes, single-use backup codes, and passkeys.
- Multi-factor authentication is optional. If you have enrolled a second factor, both data export and account deletion require it; without one, they proceed on your signed-in session alone.
- Passwords are stored only as one-way hashes, never in readable form, and sign-in sessions expire.
Monitoring and abuse protection
- Sign-in, account recovery, bank connection, and other sensitive actions are rate-limited.
- Security-relevant actions are recorded in an append-only audit log.
How we build
- Automated checks on our code confirm that the database reads and writes serving your account are scoped to you.
- Secret scanning and static security analysis run in our build pipeline, and secrets are redacted from our logs.
No method of transmission or storage is 100% secure. If a security incident affects your information, we will notify you as required by law.