Information Security and Responsible Vulnerability Disclosure

Version 1.3 · Effective 04/11/2026

1. How we look after your data

In transit. Everything that leaves the app or the website travels over an encrypted connection.

In storage. Your password is not stored in readable form: we keep only an irreversible version of it. Phone number, date of birth and payment codes are encrypted in the database. Other data you enter, such as lists, pantry items and transactions, has no encryption of its own in the database and is protected by access control. Backups are encrypted.

Access. Each person sees only what is theirs or what was shared with them, and automated tests check this. Within the team, access is restricted by role and to what is necessary.

At sign-in. You can turn on two-step verification with an authenticator app: with it, a password alone is not enough to sign in to your account. Turn it on in Settings, Account security. When you create or change your password, we reject very common ones and those that have appeared in known data leaks.

On your device. In the app, your session is kept in the device's secure vault, and Finance has a PIN and biometrics. In the browser, your session is stored in the browser itself and lasts for less time: do not use public or third-party computers.

What we do not have. We do not ask for your bank password. The subscription is paid through the App Store or Google Play, and we do not see your card number.

What you control. See your devices and recent access, export your data and delete your account in the app. More details in the Privacy Policy, section 10.

2. What has been verified

We run automated security tests and internal reviews. We have not yet undergone an independent audit. It is planned, and we will publish the summary here, with the company, the date and the scope. No system is 100% secure.

What we have verified, always with the date:

• Mozilla Observatory, automated public check: A+ grade on rufi.app, api.rufi.app and web.rufi.app (November 5, 2026). Run it yourself. It assesses the site configuration and does not replace a penetration test.
• Self-assessment based on OWASP ASVS 5.0, level 1, carried out by our team: 55 of the 67 applicable requirements fully met, and we keep working on the rest (November 2026). This is a self-assessment, not a certification: OWASP does not certify companies or products.

3. Watch out for scams

Rufi never asks for your password, verification code or PIN, on any channel. If someone asks in our name, it is a scam.

Our official addresses end in rufi.app. Support is available in the app and at suporte@rufi.app. Do not download Rufi outside the App Store and Google Play, and do not install anything at the request of someone claiming to be from Rufi.

Received something suspicious? Do not click, and let us know at seguranca@rufi.app.

4. Found a flaw?

Send it to seguranca@rufi.app with: a description, steps to reproduce, impact and (if possible) a proof of concept. We will reply within 5 business days and keep you informed.

Good-faith rules (safe harbor)

We will not take legal action against anyone who, in good faith: (a) tests only their own account; (b) does not access, change or delete third-party data; (c) does not degrade the service (no DoS, spam or massive brute force); (d) does not use social engineering against the team; (e) does not disclose the flaw before it is fixed and we agree on a timeline (suggested: up to 90 days); (f) complies with the law.

Out of scope

Automated reports without proof of exploitation, missing headers without impact, attacks on third-party providers (Apple, Google, Amazon, etc.), physical tests and social engineering.

5. Rewards

There is no formal bounty program. Public acknowledgment may be given to those who authorize it.

6. Incidents

In case of a security incident with relevant risk or harm to data subjects, we will notify you and the ANPD within the deadlines of Res. CD/ANPD 15/2024 (3 business days), stating the nature of the data, the risks and the measures adopted.

7. What you can do

A strong, unique password · two-step verification · PIN/biometrics · keep the device updated · be careful with links/attachments · distrust requests for codes or passwords (Rufi never asks for your password) · review shares and linked devices (Alexa).