Security

Last updated: August 24, 2026

1. Our approach

BillMaple is built with a "least access" and "privacy by design" mindset. We collect the minimum data needed to run the Service, isolate sensitive information, and prefer keeping credentials on your device rather than on our servers.

2. Encryption

• In transit: all communication between the app and our systems is protected with industry-standard TLS encryption.
• At rest: data stored in our infrastructure is encrypted at rest.
• On device: sensitive items are stored using hardware-backed encryption — Apple Keychain on iOS and Android Keystore on Android.

3. Credential handling

BillMaple does not ask for, receive, or store the passwords to your utility, telecom, or bank accounts. There is no account-linking feature, so there are no provider credentials for us to protect in the first place.

Your BillMaple password is handled by our authentication provider and is never stored by us in readable form. If you turn on the biometric lock, the fingerprint or face data is held by your device's operating system and checked there — it never reaches us.

4. Access & infrastructure

• Access to production systems is restricted to authorized personnel on a need-to-know basis and protected by strong authentication.
• We host on reputable cloud infrastructure with physical and network security controls.
• We log and monitor for suspicious activity and apply security updates promptly.

5. We never move money

The bills on your dashboard are the ones you add yourself — typed in, scanned with the camera, or forwarded to your import address. BillMaple does not sign in to your provider accounts to fetch anything.

When a bill is due and you choose to pay it, we open your provider's own website so that you pay them directly. We do not initiate payments, transfer funds, hold balances, or change settings on any account you hold elsewhere. This dramatically limits what could happen even in a worst-case scenario.

6. Payments

BillMaple does not process or store full payment-card numbers. Premium subscriptions are billed securely through the Apple App Store or Google Play, which handle payment data under their own PCI-compliant systems.

7. What you can do to stay secure

• Use a strong, unique password for your BillMaple account.
• Enable your device's screen lock, Face ID / biometrics, and OS updates.
• Only install BillMaple from the official App Store or Google Play.
• Contact us immediately if you notice anything unusual.

8. Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please email bill@billmaple.ca with details and steps to reproduce. Please give us a reasonable time to investigate and fix the issue before public disclosure, and avoid accessing or modifying other users' data. We will acknowledge valid reports and keep you updated.

9. Incident response

We maintain an incident-response process. In the event of a data breach that poses a real risk of significant harm, we will notify affected users and the relevant authorities as required by PIPEDA and applicable law.

10. Contact

Security questions or reports: bill@billmaple.ca. General privacy questions: Privacy Policy.