Security of your data
Financial data demands serious protection. This page describes what we guarantee to you — the outcomes, not the technical details, which we keep private for your safety.
What we guarantee to you
Concrete commitments, verified on every app update.
Only you can read your data
Every account is isolated from all others: no other user can read or write your data, under any circumstances. We verify this isolation on every single app update, before it is released.
Data always encrypted
Your data is encrypted both while it travels between your device and our servers, and while it is stored. Your most sensitive credentials are protected with an additional layer of encryption based on keys held in dedicated hardware.
Data in the European Union
Your data is stored in the European Union and processed under European law. Any non-EU providers operate under the contractual safeguards required by the GDPR.
No routine human access
No one on our team accesses your data in day-to-day operations. Any extraordinary administrative access is tracked and logged.
Your bank stays yours
We never see your banking credentials: access to your account always happens on your bank's official channel, with its strong authentication. We can only read the transactions you authorise — never initiate payments.
Complete deletion
You can delete your account directly from the app, at any time. All associated data is fully removed, including backup copies, within thirty days.
Why we don't publish technical details
Publicly describing how we defend ourselves would help those who want to attack, not those who want to be protected. That's why we state the outcomes we guarantee to you and keep the architecture behind them private. The credibility of what we state rests on independent third-party verification, not on transparency about mechanisms.
Independent verification
Third-party attestations are published here as they are issued.
Store declarations
The data-handling information declared in the “Data safety” section on Google Play and in the “Privacy Label” on the App Store is reviewed by the respective stores and consistent with what is stated on this page.
Independent security audits
When an independent security audit is completed, we publish the attestation letter issued by the auditor here. No attestations are published yet: this section will be updated as soon as they become available.
Your rights
GDPR (EU 2016/679)
We process data according to the principles of the General Data Protection Regulation. You can exercise your rights of access, rectification, erasure, portability and restriction by writing to [email protected].
We are not a bank
We don't hold money and we don't initiate payments. Connecting your bank account happens within the European payment-services regulatory framework, always with your explicit, revocable authorisation.
Found a vulnerability?
Thank you in advance. Contact us privately at [email protected] describing the issue and, if possible, how to reproduce it. We will reply within five business days and keep you updated on the resolution.
What to do: don't disclose the vulnerability publicly before it is fixed, don't access other users' data, don't run tests that could disrupt the service.
What not to do: denial of service, social engineering against our team, physical security testing, spam.
Out of scope: automated scanner reports without manual verification, purely informational best practices, vulnerabilities in third-party services (report them to their owner).
Want to know more about how we handle your data? Write to [email protected].
Read the Privacy Policy