Security
Your data is in
safe hands.
From encryption to access management, Bluto enforces rigorous standards to keep your financial data secure, private, and compliant — at every level.
Built to the highest standards
Security built on recognised frameworks.
Bluto’s security programme is built around internationally recognised frameworks and continuously enhanced to ensure your data receives the highest level of protection.
SOC 2
Our security controls are designed and operated in alignment with SOC 2 Type II principles — covering security, availability, and confidentiality across the platform.
ISO 27001
We implement information security management practices aligned with ISO 27001:2022 requirements — the internationally recognised standard for information security.
UK GDPR
Bluto operates in accordance with UK GDPR. Your data is processed only for the purpose of delivering your service — never shared, never used to train AI models.
Encryption
Encrypted at every stage.
Your financial models, projections, and business data are protected with AES-256 encryption at rest. Traffic is encrypted from the moment it leaves your browser through to the platform itself — including the connection between our network edge and our servers.
- AES-256 encryption at rest via AWS
- TLS 1.2 minimum at the edge and at the origin
- Virtually all traffic negotiates TLS 1.3
- Nothing is ever served over an unencrypted connection
Access & identity
Verified on every request.
Every request is authenticated before any data is returned. Identity and permissions are checked on each call, and credentials are scoped to the minimum access required.
- Identity and permissions verified on every request
- Email verification required before an account is active
- Credentials scoped to least privilege
Your data
Not training data.
Your financial models, projections, and documents are yours. They're processed to deliver the service you asked for, and nothing else — never used to train AI models, and never shared.
- Never used to train AI models
- Never shared with third parties
- Processed only to deliver the service you asked for
Security monitoring
Monitored continuously.
Bluto's infrastructure is continuously monitored, with automated alerting on system health and delivery.
- Continuous configuration and compliance monitoring across our AWS infrastructure
- Automated alerting with confirmed delivery
- AWS CloudTrail logs retained indefinitely
- Periodic security testing
Infrastructure
Hosted on AWS.
Based in the UK.
The Bluto platform runs on Amazon Web Services in London. A small number of internal systems supporting operations run in the UK and Europe. AWS provides enterprise-grade physical security and automated daily backups. Stripe handles all payment processing under PCI-DSS. Email is handled by AWS SES in London.
- Platform hosted on AWS in London
- Automated daily backups
- Stripe PCI-DSS for all payment data · AWS SES for email
Data ownership
Your data.
Your decisions.
Data export
Export all your financial models, projections, and documents at any time in standard formats. Your data is always accessible and portable.
Data deletion
On account closure you have seven days to export everything, after which all data is permanently deleted.
Full control
Decide what to keep, what to export, and when to leave. No lock-in, no retention you did not ask for.
FAQ
Frequently asked questions.
All data is encrypted at rest using AES-256, and in transit using TLS — with a minimum of TLS 1.2 at both the network edge and the platform itself. Virtually all traffic negotiates TLS 1.3.
The Bluto platform runs on Amazon Web Services in London. A small number of internal systems supporting operations run in the UK and Europe.
No. Your financial models, projections, and documents are processed only to deliver the service you asked for. They are never used to train AI models and never shared.
Only to provide and secure the service, when you ask us to for support, or where the law requires it.
On account closure you have seven days to export everything, after which all data is permanently deleted.
Email [email protected]. We acknowledge reports within two business days. If you're a security researcher reporting in good faith, you can do so without fear of legal action — the full terms are in our Security Policy.