Security is not optional
Your financial data is handled with the same care we use for our own, from the bank connection through storage.
How we handle data
How your data is stored, encrypted, and accessed
-
Audited providers
We host with DigitalOcean and use Cloudflare, providers that undergo independent security audits such as SOC 2.
-
Encryption by default
Connections use TLS. The app is not a bank.
-
Privacy duties
Our handling of personal information follows applicable U.S. privacy requirements. -
Controlled access
Internal access to data is limited and logged, and only people who need it can see it.
How we protect your data
Several layers of protection work together to keep your financial information safe
-
Layered encryption
Your data is encrypted at rest and in transit, with keys managed separately from the rest of the infrastructure. -
Encrypted channels
Every connection between your device and our servers is encrypted with TLS. -
No credentials in plain text
Your bank credentials are never stored in readable text, and our team cannot look them up.
-
Logged access
Our servers sit with audited providers, and access is logged. -
Stronger sign-in
Your account can be protected with a second step, beyond the password.
-
Limited bank access
The connection to your bank accounts is read-only. The app cannot start a payment.
Privacy
Two ideas behind every use of personal information
Legal framework
- Follows applicable U.S. privacy law
- A current record of processing
- Defined retention periods
- Rights to access and delete
Privacy by design
- Collect only what we need
- Anonymize when we can
- We do not sell personal information
- Transparency about service providers
Our commitments in numbers
- Encryption
- Staff access
- Logged
- Read only
256-bit
Bank access
Report a vulnerability
If you find a security weakness in our products, a quick report helps us protect every user.
That includes weaknesses in third-party components inside our products, not only our own code.
Support
Describe the issue in the usual support form, and say that it is a security report.
Contact supportDirect
Email us directly if you want a detailed written exchange with the technical team.
[email protected]