Security

Reliable, secure, and confidential

Q: Can Buddy's investors see my data?

No. Investors and shareholders have no access to customer data of any kind.

Q: Do you sell my data or use it to train AI?

No. We never sell your data, and we don't use it to train AI. It's shared only with the service providers that run the platform.

Q: Does Buddy hold or move my money?

No. Payments go directly between you and your trading partner; Buddy never holds or moves money. We store the bank details you share encrypted, and we recommend confirming them by phone before you pay.

Q: Does Buddy check that bank details are correct?

No, we don't verify payment details. We make sure payment details come from the supplier through Buddy, warn buyers when they change, and keep a record of who changed them. Always call to confirm before you pay.

Q: Can I export my data?

Yes. You can export your trade and listing data at any time, and all documents can be downloaded.

Q: Where is my data stored?

Your account and trade data is stored in the United States (California) on Railway, and uploaded files and documents in Australia (Sydney) on AWS.

Q: Is Buddy SOC 2 audited?

Our SOC 2 Type II audit is under way, covering Security and Confidentiality. We expect the report in Q1 2027.

Q: How do I report a security issue?

Contact us through our contact page.

Everything in Buddy is designed to keep your data safe and in your control. Because your business is nobody else's business.

Reliable

Built to stay available and recover fast

Secure infrastructure

Hosted on Railway and AWS, both certified to SOC 2 Type II, with storage encrypted using AES-256.

Continuous backups

Every change is backed up continuously, so we can restore to any moment in time, alongside daily snapshots kept for 7 days, weekly for 30 and monthly for 90.

Tested recovery

Restores are tested under our business continuity and disaster recovery plan, so we know they work before we need them.

Secure

Protected at every layer, and independently tested.

Encryption

Bank details are encrypted a second time inside our database, so even a copy of it wouldn't expose them. Everything else is encrypted at rest, and all traffic is HTTPS-only.

Secure sign-in

Accounts lock after repeated failed attempts, sign-in codes expire in minutes, and we email you whenever your password or email changes. If we suspect an account is at risk, we sign it out everywhere.

Edge protection

Traffic passes through Cloudflare, which filters attacks and abusive traffic before it reaches Buddy.

Secure development

Every change is peer-reviewed, security-scanned and tested before it ships, and our dependencies are checked for updates every day.

Penetration testing

Independent security specialists test our platform at least once a year, and a summary is available under NDA.

Monitoring and incident response

Our incident response plan sets out how we detect, contain and tell you about security incidents.

Confidential

Your data, shared on your terms

Data kept separate

Our platform is built to keep each customer's data strictly segregated from other customers and marketplace participants.

Role-based access

You decide what each person on your team can see and do, from whole roles down to individual permissions.

Full change history

Every change to a trade, offer, shipment or bank detail is recorded with who made it and when.

FAQs

Can Buddy’s investors see my data?

Do you sell my data or use it to train AI?

Does Buddy hold or move my money?

Does Buddy check that bank details are correct?

Can I export my data?

Where is my data stored?

Is Buddy SOC 2 audited?

How do I report a security issue?