Security

How we protect your money and data.

Read-only by design

Bank connections use a regulated data provider and give SpendySaver read-only access to balances and transactions. SpendySaver has no ability to move money, and never holds funds. We never see or store your bank password.

Encryption

All traffic uses HTTPS (TLS). Bank access tokens are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt.

Your account

• Two-step sign-in with an authenticator app
• "Sign out everywhere" in Settings
• Delete your account and data at any time
• Advisors you invite get read-only access

Fair, private advertising

We don't sell personal data and don't use your transactions to target ads. Sponsored placements are labelled and kept out of rankings.

Report a vulnerability

Email security@spendysaver.com. Please give us reasonable time to fix an issue before disclosing it. We won't take legal action against good-faith research that avoids privacy violations and service disruption.