Security
Your financial data is sensitive. Here is exactly how we protect it, without the marketing fluff.
No bank login, ever
DonkeyBucks does not offer bank connections. You import statements as CSV files or enter transactions by hand, and no bank login is required to use any part of the product. DonkeyBucks never asks for or stores your bank username or password.
There is no mechanism for us to receive your bank credentials, because there is no login flow to a bank anywhere in the current product.
A small number of accounts connected through SimpleFIN before August 2026 continue to sync read-only until their owner removes them. Those connections use a token the account owner created directly at SimpleFIN, and DonkeyBucks never sees bank credentials.
Authentication: Clerk
User authentication is handled entirely by Clerk, a SOC 2 Type II certified identity platform. Clerk manages password hashing, session tokens, and OAuth flows. DonkeyBucks never handles or stores passwords.
Sessions use JWT tokens with short expiry windows. Clerk supports multi-factor authentication if you want to enable it.
Data storage: Convex Cloud
All application data is stored in Convex Cloud. Data is encrypted in transit via TLS and encrypted at rest in the database. Convex runs on AWS infrastructure with standard cloud security controls.
Each user's data is isolated by user ID and workspace ID. There is no shared data pool between users.
Automatic categorization: user-triggered with hard limits
Automatic categorization is never running in the background. It runs only when you click the button. When triggered, batches of transaction data (merchant names, amounts, dates) are sent over TLS to a hosted categorization model.
We learned the hard way that unbounded model calls are a real risk ($100 in 2 minutes during early development). DonkeyBucks has hard limits baked in: 20 transactions per batch, maximum 3 batches per trigger, 10 batches per hour per user, and a database lock that prevents concurrent runs. These are code-level enforcements, not just policy.
The provider processes data under its API terms and does not use API inputs to train models.
Report a vulnerability
If you find a security issue, please email hello@donkeybucks.com with "Security" in the subject line. We will respond within 48 hours.
We do not have a formal bug bounty program yet, but we take every report seriously and will work quickly to fix confirmed vulnerabilities. We will credit researchers who report valid issues if they want credit.