How Blueprint Keeps Your Financial Data Safe

Your Financial Data Deserves More Than a Password

Most people don't think about app security until something goes wrong. We think about it before anything goes right.

Blueprint connects to your bank accounts, your calendar, and your financial goals. That's some of the most sensitive data that exists. We take that seriously — and we want you to know exactly how it's protected.

Here's a plain-English breakdown of every security layer in Blueprint.

We Never See Your Bank Credentials

When you connect your bank to Blueprint, you're never entering your username or password into our app. That process is handled entirely by Plaid — the same technology trusted by Venmo, Robinhood, Cash App, and thousands of other financial apps.

Here's how it works:

1. You click "Connect Bank" in Blueprint

2. A secure Plaid window opens — hosted by Plaid, not Blueprint

3. You enter your bank credentials directly into Plaid's encrypted interface

4. Plaid gives Blueprint a secure access token — never your actual credentials

5. Blueprint uses that token to read your transactions — nothing more

Blueprint never sees, stores, or has access to your banking username or password. Ever.

Your Bank Tokens Are Stored Server-Side Only

The access tokens Plaid provides are stored exclusively on our servers — never in your browser, never in a cookie, never accessible to client-side code.

This matters because it means even if someone intercepted your network traffic, they couldn't extract your bank access tokens. They're locked away server-side and only used when your account explicitly requests data.

Every API Request Is Verified

Every single API call in Blueprint — fetching transactions, loading your budget, accessing your calendar — requires a verified session before any data is returned.

This protects against a common attack called IDOR (Insecure Direct Object Reference), where an attacker tries to access another user's data by guessing their ID. In Blueprint, even if an attacker knew your user ID, they couldn't access your data without a valid, active session matching that exact account.

Your data can only be accessed by you.

Payments Handled by Stripe

Blueprint uses Stripe for all subscription payments — one of the most trusted payment processors in the world, used by Amazon, Google, and millions of businesses.

Blueprint never sees your card number. It goes directly to Stripe's PCI-compliant infrastructure. When Stripe notifies Blueprint of a successful payment, we verify the notification using a cryptographic signature — so even fake payment notifications can't be used to manipulate your subscription.

Calendar Tokens Are Protected the Same Way

When you connect Google or Outlook Calendar, the OAuth tokens are stored server-side in our database — never exposed to the browser. The OAuth flow uses a secure state parameter to prevent cross-site request forgery, and tokens are tied to your specific account.

Row-Level Security on Every Table

Our database (Supabase/PostgreSQL) uses Row Level Security (RLS) on every table. This is a database-level policy that enforces: even if someone somehow bypassed our API layer, the database itself would reject any query trying to access another user's data.

It's a second lock on the door.

Security Headers on Every Response

Every response from Blueprint includes a full set of HTTP security headers:

These are industry-standard protections that many apps skip. We don't.

Support Can Only See Your Data With Your Permission

If you ever contact Blueprint support, we cannot access your account data without your explicit consent. There's a toggle in Settings → Security called Support Access — it's off by default.

Only when you turn it on can our team view your account to help troubleshoot. The moment your issue is resolved, you can turn it off again. Your data, your control.

The Bottom Line

Security isn't a feature we added at the end — it's how Blueprint was built from day one. Every data decision, every API route, every third-party integration was chosen with your protection in mind.

You're trusting us with your financial life. We don't take that lightly.

Try Blueprint free for 30 days — your data is safe with us.

TRY BLUEPRINT FREE

Your budget, your calendar, your goals — unified.

30-day free trial. No credit card required. Connect your bank and calendar in under 10 minutes.