Security
The safest data is the data we never ask for.
Most finance apps reduce risk by protecting what they hold. TrakBuk starts a step earlier, by holding as little as possible in the first place.
What TrakBuk never stores
Your bank login
There is no bank connection to authorise. TrakBuk cannot sign in to your bank because it never asks for the credentials.
Your BVN
It is never requested, never stored, and never written to a log.
Full account numbers
An account is identified by its last four digits and a name you choose. The rest is not kept.
A readable password
Passwords are hashed before storage. Nobody at TrakBuk can read yours, including us.
Your card details
There is no billing to collect them for. Nothing to charge, nothing to store.
The statement file itself
It is parsed on upload and discarded. The transaction rows remain; the original file does not.
No connection to your bank, by design
TrakBuk reads statement files you upload yourself. It holds no keys, tokens or credentials to any bank account, cannot move money, and cannot initiate a payment or transfer. If TrakBuk disappeared tomorrow, there would be nothing of yours for anyone to take control of.
That is a real trade-off and worth saying plainly: it means importing a statement is a thing you do, not something that happens automatically in the background. We think it is the right trade for a product holding this kind of data.
Your data is fenced off from everyone else's
Every record belongs to one customer account, and within it to one workspace. Queries are scoped at both levels rather than filtered in the interface, and that separation is covered by automated tests that run on every change — including tests that deliberately try to read another account’s data and must fail.
Sharing a business workspace grants access to that workspace only. Removing someone ends their access immediately; the records they added while they were a member stay with the workspace.
Getting in, and staying in
You have to verify your email address before any financial data can be imported or reviewed. Sessions use tokens that expire rather than a login that lasts forever, and changing your password invalidates existing ones. Actions that change access are recorded — what happened and by whom, never request bodies, passwords, transaction narrations or account numbers.
Leaving is a first-class feature
You can download everything as an Excel workbook whenever you like, without asking anyone. Deleting your account takes an email confirmation, then holds for seven days so an accidental or malicious request can be cancelled, then removes your profile and financial records permanently.
What we will not claim
No service can promise absolute security, and any product that tells you otherwise is selling something. We also do not sell financial data — there is no business model here that depends on it. Our full privacy and data retention policy sets out exactly what is stored and for how long, and is being reviewed against Nigeria’s data protection requirements ahead of public launch.