Security
Your shop's records are yours
Your sales, stock, customers and money are the most private things your business has. This page says plainly how Budget Pro keeps them safe — and nothing we do not actually do.
Every shop is kept separate
- Every record — every sale, product, customer and payment — carries the shop it belongs to.
- Every request made by a signed-in person is filtered to their own shop automatically, by the system rather than by each screen remembering to.
- A changed or forged form cannot write into another shop: the shop and the person are always taken from the sign-in, never from the page.
Roles and permissions for your staff
- Six roles — owner, manager, cashier, stock keeper, accountant and viewer — each with a clear list of what it may do.
- Cost prices and profit are only shown to roles allowed to see them, on the phone and on the computer.
- Discounts, price changes, voids and stock corrections are limited to the roles you trust with them.
- Unless you decide otherwise, only the owner can change billing, the team and the shop's settings.
A history that adds up
- Stock is a record of movements — sold, received, damaged, returned, counted — never a number overwritten in place.
- A sale is voided, not deleted, and a stock mistake is corrected with a new entry, so the trail is always complete.
- Money entries made by the system (from sales and payments) cannot be edited or deleted by hand.
- Every sale, void, payment and stock change records who made it and when.
Nightly backups, tested restores
- The whole database is backed up automatically every night.
- Every week the latest backup is restored into a separate test database and checked, so we know a restore works before we ever need one.
- Recent backups are kept on a rotation.
Passwords, sign-in and links
- Passwords are stored only as secure one-way hashes — nobody, including us, can read them.
- Repeated wrong passwords are slowed down, and one-time sign-in codes expire after a few minutes.
- The website and the app talk to our servers over encrypted HTTPS connections.
- A receipt shared with a customer opens from a long random link, not a sale number anyone could guess.
Phones
- An optional PIN locks the app on a shared phone; repeated wrong PINs lock it for longer each time.
- Signing out removes the shop's data from the phone (with a warning if anything is still unsent), and signing in to a different shop clears the old one first.
- You can see which phones are connected to your shop and remove one you no longer trust.
Your data, your decision
- Export your shop's records whenever you like. Exports never include passwords, sign-in tokens or codes, and are removed after 7 days.
- Closing your shop needs the owner's password and has a 30-day period to change your mind; after that, every record of that shop is removed.
- A late payment never deletes anything: the shop keeps working through a grace period, then falls back to the Free plan.
Offline, without losing anything
- Sales made offline are saved on the phone and sent when the connection returns.
- A finished sale is never rejected at sync — money changed hands — and anything unusual, like stock going below zero, is flagged for a person to check.
- Each phone knows exactly what it has sent, so nothing is sent twice.
Found a problem?
Tell us about it
If you think you have found a security weakness in Budget Pro, please tell us privately first so we can fix it before anyone else finds it. We read every report and will reply.
Safe records, from your first sale
Every protection on this page is on for every shop, on every plan — including the free trial.