Last updated: August 16, 2026
You're trusting us with sensitive documents — your ID, proof of address, and details about disputes tied to your credit file. Here is exactly what protects that information, in plain terms, with nothing overstated.
Every case, document, and dispute record in our system is enforced by row-level security policies directly in the database — not just permission checks in the app. That means even if a bug existed somewhere in our application code, the database itself refuses to return another customer's data to your account. Every table is scoped to your login, not just the screens you see.
All traffic between your browser and 3B Credit Builder is encrypted over HTTPS/TLS. Your documents and account data are stored on infrastructure that encrypts data at rest. We don't operate our own data centers — we run on established cloud infrastructure providers who are directly responsible for the physical and network security of the underlying storage.
You can turn on two-factor authentication (TOTP, using any standard authenticator app) from Settings. Once enabled, a code from your phone is required every time you sign in, in addition to your password. Recovery codes are provided at setup in case you lose access to your authenticator app.
Your government ID and proof of address live behind an additional PIN — separate from your login password. The PIN itself is never stored in readable form; it's hashed with bcrypt before it ever touches our database. Unlocking the vault only lasts 15 minutes before you need to re-enter it, and after 5 incorrect attempts the vault locks for 15 minutes regardless of whether the correct PIN is entered — a real, enforced lockout, not just a warning.
Throughout the dispute workflow — approval screens, generated letters, internal records — account numbers are referenced by their last 4 digits only. Full account numbers are never required by our platform and are not stored for this purpose.
When you approve a dispute item, that approval is written to an audit log that cannot be edited or deleted after the fact — by you, by us, or by anyone with access to the system. If a dispute item changes after you approved it, our system detects the mismatch automatically and requires re-approval before anything is generated or mailed on your behalf.
Hiding a button in the app isn't a security control — anyone could still call the underlying request directly. Every action that touches your data — viewing a case, approving a dispute, generating a letter, sending mail — is independently checked against who you are and what you own on our servers, every single time, regardless of what the interface shows.
Billing is handled entirely by Stripe. Your card number and payment details are sent directly to Stripe's systems — we never receive, process, or store your full card number ourselves.
We do not ask for or store your Social Security number anywhere in the platform. Anything we don't need to help you dispute an item, we don't collect.
We take reports seriously and want to hear about them directly rather than have them posted publicly first. Email us at security@bouncebackbrian.com and we'll respond.