SurviveOnAnyBudget

Data Security & Protection

How we protect your personal data, nutrition information, and account security across all SOAB platforms.

Last Updated: September 10, 2026

1. Our Security Commitment

At SurviveOnAnyBudget, we treat your data especially nutritional preferences and health-related information you share voluntarily as sensitive. This policy outlines the technical and organizational measures we implement to protect your privacy and ensure account integrity across our website, programs platform, and OmniPlate mobile app.

2. Data Protection Measures

2.1 Encryption

  • In Transit: All data transmitted between your device and our servers is encrypted using TLS 1.3 (HTTPS). No plain-text requests are permitted.
  • At Rest: Databases containing personal information, nutrition profiles, and meal logs are encrypted at rest using AES-256 encryption.
  • App Storage: OmniPlate uses device-level secure storage (Keychain/Keystore) for authentication tokens. No sensitive data is stored in plaintext on-device caches.

2.2 Access Control

  • Role-based access: Only specific team members can view user data, and only for support/operations purposes.
  • All internal access to production databases is logged and auditable.
  • Nutritionist 1-on-1 program participants see ONLY their assigned client's dietary profile no cross-client visibility.

2.3 Authentication & Sessions

  • Email + password authentication with bcrypt-hashed passwords (never stored in plain text).
  • Session tokens expire after 30 days of inactivity.
  • Rate-limiting on login attempts to prevent brute-force attacks.
  • Optional: App-level biometric unlock (fingerprint/face ID) supported where the device allows it.

3. Mobile App Security (OmniPlate)

  • App communicates exclusively over encrypted channels no data flows through unsecured connections.
  • Local meal logs and tracking history are stored in the app's sandboxed storage, not shared with other apps on your device.
  • Purchase receipts and subscription status are verified server-side to prevent tampering.
  • We do NOT request excessive device permissions. OmniPlate does NOT access contacts, location, camera, or microphone unless a specific feature explicitly requires it (e.g., barcode scanning for food logging).

4. Vulnerability Management

We maintain an ongoing security posture through:

  • Automated dependency scanning on every code deployment (SAST + SCA).
  • Periodic penetration testing of the API and web application.
  • Prompt patching of known vulnerabilities critical issues addressed within 72 hours of identification.
  • Security headers on all responses (CSP, HSTS, X-Frame-Options) to prevent common web attacks.

5. Data Breach Response

In the unlikely event of a security incident that compromises your personal data:

  1. We contain and investigate the breach immediately.
  2. Affected users are notified within 72 hours via email with clear explanation of what happened, what data was involved, and recommended next steps.
  3. Regulatory authorities are notified as required by applicable law (GDPR, state laws).
  4. A post-incident report is produced to prevent recurrence.

6. Third-Party Services & Data Flow

SOAB uses a limited set of vetted third-party services:

  • Cloud Hosting: Production infrastructure hosted on ISO 27001-certified cloud providers.
  • Payment Processing: Stripe (PCI-DSS Level 1 certified). We never store full credit card numbers all payment data is tokenized by Stripe.
  • Email Delivery: Transactional emails via a GDPR-compliant email service provider. Marketing emails honor opt-out preferences immediately.

7. Report a Security Concern

If you discover a security vulnerability or suspect unauthorized access to your account:

  1. Securely change your password immediately.
  2. Contact our security team at the email below with details of what you observed.
  3. We will investigate and respond within 48 hours. No retaliation for good-faith reporting.

8. Contact

SOAB Security Team

For vulnerability reports, data breach concerns, or security questions.

security@surviveonanybudget.com