Security
Not a marketing page — a specific, honest list of what we actually do. We'll update it as it changes, not embellish it because it's a landing page.
Rate-limited sign-in
Login, signup, and password-reset attempts are rate-limited by our authentication provider, so repeated guesses are throttled before they can get anywhere near your account. Stronger bot verification is on our roadmap — we'll add it here once it's actually enforcing, not before.
Breach-checked passwords
New and changed passwords are checked against known leaked-password databases before they're accepted. If your chosen password shows up in a breach list, we reject it and ask for a different one.
Row-level access control
Every table in our database enforces row-level security policies — your vaults, transactions, and profile are only ever queryable by you. This isn't application-layer logic that a bug could bypass; it's enforced at the database itself.
Encrypted in transit and at rest
All traffic between your device and Bagsly is encrypted over HTTPS. Your data at rest is encrypted using our infrastructure provider's standard database encryption.
Server-side authorization on every transaction
Balance changes are never trusted from the client. Every deposit, withdrawal, and transfer is validated and authorized on our servers before anything is written — ownership checks, balance checks, and penalty math all happen server-side.
Regular internal review
We periodically audit our own database permissions and access policies rather than assuming they stay correct as the product changes.
Where we are today
Bagsly is early. We're not FDIC insured, we don't custody funds through a bank partner yet, and we'd rather tell you that plainly than let a vague security page imply otherwise. What's above is real and live today; anything involving how your money is actually held will get its own clear explanation once it exists.