Luura Security Policy

Last updated: 5 October 2026

1) Our approach to security

Luura is built with security and privacy as foundational principles. We take a proportionate, risk-based approach that reflects how the app is currently used and the sensitivity of the data involved.

Luura does not currently connect to your bank. You can upload your bank statements or add transactions manually, and subscriptions use native in-app purchasing.

2) Bank statements and bank connections

Luura does not connect to your bank at the moment. You can upload your bank statements as often as you like. Luura reads the transactions, adds only the ones it does not already hold, and categorises them. You can also add transactions manually.

• Luura never asks for or stores your bank login credentials
• Uploaded statements are sent to Luura over an encrypted (HTTPS) connection
• You can delete transactions, or your whole account, at any time

In future, Luura plans to offer read-only bank connections through an FCA-authorised Open Banking provider. When that launches:

• Bank access is read-only
• Luura never sees or stores your bank login credentials
• You authenticate directly with your bank during connection
• You can revoke access at any time via your bank or within Luura
• The Open Banking provider will manage consent, authentication, and secure transmission of data between banks and Luura.

3) Platform and infrastructure security

Luura is built on the Bubble platform and hosted on Amazon Web Services (AWS).

• All data is encrypted in transit using HTTPS
• Data at rest is protected by the encryption and security controls of our hosting platform (Bubble on AWS)
• AWS provides physical, network, and infrastructure-level security
• Bubble performs ongoing platform-level security monitoring
• Luura uses Bubble’s separation between development and live environments to reduce change risk. The development environment contains no live customer data.

4) Application security

• Passwords are securely hashed and never stored in plain text
• Access to user data follows least-privilege principles
• Database privacy rules ensure users can only ever access their own data
• Administrative access is restricted and protected
• Input validation reduces common application security risks

5) Data access and internal controls

Access to production data is tightly controlled.

• Only authorised personnel can access live systems
• Access is granted solely for operational or support purposes
• Administrative access is restricted. Access is granted only when required for operational/support purposes and is reviewed periodically.
• No third party is given unrestricted access to user data
• Multi-factor authentication is enabled on all administrative accounts
• Our development agency operates under a signed data processing agreement, with access ordinarily limited to the development environment

6) In-app purchase security

Luura uses native in-app purchasing provided by the Apple App Store and Google Play Store.

• Luura does not process or store payment card details
• Payments are handled directly by Apple or Google
• Luura receives only limited purchase and subscription status data
• All payment processing follows platform security requirements

7) Data storage, backups and resilience

• User data is stored securely on AWS via Bubble
• Point-in-time database backups are provided by the hosting platform as part of its managed service; backups expire on a rolling basis within 14 days
• Systems are designed to recover from service interruptions
• Availability and performance are monitored

8) Incident response

We maintain documented incident response procedures covering identification, containment, remediation, recovery and notification, supported by 24-hour access to specialist legal, forensic and breach response services through our cyber insurance. If a security incident or personal data breach is identified:

• The issue is investigated and contained promptly
• Affected systems are secured
• Users are notified where required by law
• Regulators are informed in line with UK GDPR obligations

9) Continuous improvement

Luura’s security measures are reviewed regularly and will evolve as the product grows, including enhanced controls as new features are added.

10) Your role in staying secure

• Use a strong, unique password
• Keep your login details private
• Log out on shared devices
• Contact us if you notice suspicious activity

11) Contact

For security questions or to report a concern:

Email: support@luurafinance.app
Company: Luura Finance Ltd, 167-169 Great Portland Street, London, England, W1W 5PF