In one paragraph. Eden Budget protects your account with Argon2id passwords, optional TOTP and WebAuthn passkeys, AES-256-GCM encryption at rest for sensitive secrets, TLS 1.2+ in transit, server-side sessions in Redis, and rate-limited authentication endpoints. Angel runs on hardware we own; your chats never go to a third-party AI vendor. We run no third-party analytics. We will tell you within 72 hours if anything in here changes for the worse.
What we deliberately don't do
- Store plaintext passwords, log passwords, or transmit them to any third party.
- See your full credit-card number, CVV, or PayPal credentials. Payment processors handle that for us.
- Send Angel conversations to OpenAI, Anthropic, Google, or any external AI vendor.
- Run Google Analytics, Mixpanel, PostHog, Amplitude, Plausible, Segment, or any third-party behavioral analytics.
- Embed session-replay scripts, heatmaps, or advertising pixels.
- Log request or response bodies for endpoints that carry personal data.
- Use your bank credentials. SimpleFIN's access URL is read-only and never authorizes us to move money.
Audit posture: honest disclosure
Eden Budget is operated by a single-member LLC. We do not currently hold SOC 2, ISO 27001, or PCI-DSS certifications in our own name. The data centers we host in (Hetzner) carry ISO 27001 certification, and our payment processors (PayPal, Helcim) are PCI-DSS Level 1 certified for the card processing they perform. We rely on those certifications for the parts of the stack they cover, and we apply industry-standard controls for the parts we operate ourselves, as described below. We will update this section if and when we obtain certifications of our own.
Hosting and infrastructure
Eden Budget production runs on dedicated Hetzner Online GmbH infrastructure in Ashburn, Virginia, United States. The Hetzner data centers operating that region carry ISO 27001 certification and provide 24/7 on-site staff, biometric access controls, surveillance, redundant power, and environmental monitoring. Application servers, the PostgreSQL primary, and the Redis session store sit on a private internal network; only the public reverse proxy is reachable from the internet, and it terminates TLS for every request.
Encryption in transit
Every request to and from Eden Budget is served over HTTPS using TLS 1.2 or higher, negotiated through the rustls implementation. HTTP redirects to HTTPS. We send the Strict-Transport-Security header with a one-year max-age, includeSubDomains, and preload eligibility so browsers refuse plaintext connections. Outbound requests from Eden Budget servers to SimpleFIN, PayPal, Helcim, and our self-hosted Angel LLM are likewise TLS-only.
Encryption at rest
Sensitive secrets stored in PostgreSQL (such as your SimpleFIN access tokens and TOTP seeds) are sealed with AES-256-GCM using a key held in environment-scoped secrets, not in the database. The disk backing PostgreSQL itself uses full-disk encryption provided by the host operating system. Database backups are encrypted before they leave the production network and stored in Cloudflare's object-storage service (Cloudflare R2).
Key management and rotation
Application secrets (database password, encryption keys, session-signing keys, third-party API tokens) are stored in environment files outside the database and outside the git history. The encryption key that seals SimpleFIN tokens is rotatable; on rotation we re-encrypt existing tokens with the new key during a maintenance window. Session-signing keys rotate on each deploy in production. Compromised keys are rotated immediately and notification is sent to affected users.
Password storage
Account passwords are stored as Argon2id hashes (RFC 9106) using a per-password random salt and parameters tuned for the production server's CPU. Eden Budget never stores plaintext passwords, never logs passwords, and cannot recover a forgotten password; it can only reset it through a verified email.
Two-factor authentication and passkeys
You can enable a second factor at any time from Settings:
- Time-based one-time passcodes (TOTP, RFC 6238) generated by any standard authenticator app.
- WebAuthn passkeys (FIDO2) bound to a hardware key, your phone's secure enclave, or your operating system's credential manager.
TOTP seeds are encrypted with AES-256-GCM before being written to the database. WebAuthn stores only the public credential; the private key never leaves your device.
Passkeys and biometric data (BIPA, CUBI, WA HB 1493)
If you register a passkey using a fingerprint, face, or other biometric sensor on your device, the biometric data itself is captured, processed, and stored only on that device by your operating system or hardware key. Eden Budget receives only an opaque public credential identifier; we do not receive, store, or have any way to derive your fingerprint, face geometry, or any other biometric template. This means we do not collect "biometric identifiers" or "biometric information" as those terms are defined by the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code Sec. 503.001), the Washington biometric privacy statute (RCW 19.375 / HB 1493), or analogous laws. When you delete a passkey from Eden Budget, we delete its public credential record; the on-device biometric data is governed entirely by your device's settings and is removed by the platform when you remove the passkey from your device.
Session security
Sessions are tracked by an encrypted, signed cookie set with HttpOnly, SameSite=Lax, and (in production) Secure flags. The cookie value is a random session identifier that resolves to a server-side record in Redis. "Remember me" extends the session lifetime to 30 days; otherwise the session ends with the browser. Logging out invalidates the server-side record so the cookie cannot be replayed.
HTTP security headers
Pages are served with a Content-Security-Policy header restricting script and style sources to first-party origins, an X-Content-Type-Options: nosniff header, an X-Frame-Options: DENY header to prevent click-jacking, and a Referrer-Policy of strict-origin-when-cross-origin so outbound clicks do not leak the path you came from. We do not set Permissions-Policy entries that would request unnecessary browser capabilities.
Brute-force and abuse protection
Failed login attempts are recorded with IP address and user-agent. After a configurable threshold, the account is locked for a cooldown period and a notification is sent to the account email. Sensitive endpoints (login, sign-up, password reset) are also rate-limited per client IP at the application layer. OAuth callbacks are CSRF-protected with a single-use state token bound to the originating session.
Email authentication
Outbound mail from edenbudget.com - including transactional mail from no-reply@edenbudget.com, support replies from support@edenbudget.com, and product-update mail from info@edenbudget.com - is sent through SMTP with TLS (port 587, STARTTLS). The sending domain is configured with SPF, DKIM, and a strict DMARC policy so receiving providers can verify our mail and quarantine impersonations. We do not embed remote tracking pixels in outgoing email. Mail claiming to come from Eden Budget that fails those authentication checks is not from us.
Payment data
Eden Budget never sees full credit-card numbers, CVVs, or full PayPal credentials. Payments are processed by PCI-DSS Level 1 certified providers (currently PayPal Holdings, Inc. and Helcim, Inc.). We store the last four digits, the card brand, and a non-reversible processor token sufficient to manage your subscription, plus the billing IP and user-agent to detect fraudulent renewals.
Bank data (SimpleFIN)
If you choose to link an institution, Eden Budget uses the SimpleFIN open standard. SimpleFIN gives Eden Budget a single read-only access URL scoped to the accounts you authorized; we cannot move money, change passwords, or read non-financial messages. The access URL is sealed with AES-256-GCM in PostgreSQL. You may revoke access at any time from Manage Connections; revocation deletes the stored token immediately.
Angel (in-product AI) privacy
Angel runs on a self-hosted large-language-model server on a private LAN controlled by Eden Living LLC. Your messages to Angel never leave Eden's infrastructure. We do not send Angel conversations to OpenAI, Anthropic, Google, or any other third-party AI provider. No external party trains models on your conversations. Angel responses are generated on demand from the prompt you submit and discarded after the response is returned; we deliberately omit any persistent logging of full chat contents.
Analytics and tracking
Eden Budget does not run Google Analytics, Mixpanel, PostHog, Amplitude, Plausible, Segment, or any third-party behavioral analytics. We do not embed session-replay scripts. We do not run advertising pixels. The only telemetry we collect is server-side error logs (used to fix bugs) and login events (used to detect account takeover).
Subprocessors
- Hetzner Online GmbH - production hosting, Ashburn, Virginia, United States.
- SimpleFIN Bridge - bank data aggregation, only if you opt in by linking an institution.
- PayPal Holdings, Inc. - payment processing for PayPal-based subscriptions.
- Helcim, Inc. - card payment processing.
- Cloudflare, Inc. - encrypted off-site backup storage (Cloudflare R2). Backups are encrypted before upload; Cloudflare cannot read their contents.
Supply-chain security
Eden Budget is built in Rust. Dependencies are pinned in Cargo.lock and reviewed for known advisories before every release using cargo-audit. We follow security advisories for our core dependencies (Leptos, axum, sqlx, rustls, reqwest, tower-sessions, argon2, webauthn-rs) and update promptly when advisories are issued. CI builds run in isolated, ephemeral environments with no production secrets.
Internal access controls
Production credentials are held only by the operator of Eden Living LLC. There are no shared admin accounts. Database access requires a key pair plus a bastion-level network position; routine debugging is performed against anonymized snapshots, not live PII. Code changes go through a build, lint, and test pipeline before reaching production.
Backup and recovery
PostgreSQL is backed up daily. Backups are encrypted in transit and at rest, uploaded to Cloudflare R2 object storage in a region geographically separate from the production database, and retained for 30 days. We run periodic restore drills to verify that backups are usable. We have a documented recovery procedure for the application server, the database, and the session store.
Incident response and breach notification
If we discover unauthorized access to your personal data, we will notify the affected account holders within 72 hours of confirmed discovery, by email, and we will publish a public post-mortem describing the scope, the root cause, the remediation, and the prevention plan. We will cooperate with applicable regulators where notification is required by law.
Responsible disclosure
If you believe you have found a security vulnerability, please email support@edenbudget.com with reproduction steps. We commit to acknowledging your report within five business days, keeping you informed of progress, and not pursuing legal action against good-faith researchers who avoid harming other users, do not exfiltrate data beyond what is necessary to demonstrate the issue, and do not publicly disclose before we have had a reasonable opportunity to fix the issue.
How you can help secure your own account
- Use a long, unique password. Eden Budget is one place a password manager pays for itself.
- Enable a second factor: TOTP and WebAuthn passkeys are both in Settings.
- Log out on devices you do not control; "Remember me" should be off on shared computers.
- Treat password-reset emails and security alerts as real. If something looks suspicious, do not click the link; visit edenbudget.com directly.
- Email support@edenbudget.com if you receive a message claiming to be from us that you cannot verify.