Security and Privacy

Your data security and privacy is our top priority

Our "Privacy-first" philosophy

We have a privacy-first philosophy at FinWise, we consider the data we collect and use about you in order to provide our service as your own. We never sell your data, and we share it only with the service providers and partners described in our Privacy Policy.

Securely connecting your accounts

We securely connect to banks and financial institutions through trusted service providers, namely Plaid, Yodlee and GoCardless, established providers that specialise in secure bank connections. These service providers are also trusted and used by prominent financial institutions including Stripe, Venmo and Robinhood and many others.

Your bank login details are never seen or stored by FinWise. When you connect an account, you sign in on the provider's own secure screen, or directly with your bank, and your login details go only to them. This can be verified by inspecting the source code of our dashboard (Right-click view source & inspect) and also by looking at the network requests in your browser's developer tools.

Whats more is that more and more banks are starting to provide a more secure login process called OAuth, which lets you connect your bank accounts to FinWise without ever having to enter your login details into Plaid or Yodlee. This is something we are very happy about and are actively encouraging banks and financial institutions to adopt.

To learn more about the security and privacy of Plaid, Yodlee and GoCardless, you can read their privacy and security pages here:

• Plaid: https://plaid.com/safety
• Yodlee: https://www.yodlee.com/europe/legal/privacy-notice
• GoCardless: https://gocardless.com/security/

How we keep your data safe and secure

We follow established security practices to keep your data safe on FinWise.

Some of the things we do to keep your data safe and secure include:

• Encryption for data in transit and at rest in our database, with an extra layer of encryption for bank connection tokens and two-factor authentication secrets.
• We use secure and trusted hosting providers for our infrastructure (Heroku/AWS).
• Our team's access to infrastructure and service providers uses strong passwords and multi-factor authentication.
• Access to production systems is limited to the people who need it.
• Authentication and authorization code is covered by automated tests that run on every change.
• Automated secret and vulnerability scanning runs on our code and dependencies.

Our commitment to your privacy and security

We are committed to your data privacy and security, here is how:

FinWise is built around the requirements of privacy laws such as the GDPR and South Africa's POPIA, drawing on our engineering team's years of work with large international financial institutions. We intend to pursue independent security certification as FinWise grows.

We would also like to open source FinWise over time, so that anyone can review and scrutinize our code.

Reporting a vulnerability

If you believe you've found a security issue in FinWise, we want to hear from you. Email us at [email protected] with as much detail as you can — affected URL, reproduction steps, impact, and any proof-of-concept. The same address is published in our /.well-known/security.txt file per RFC 9116.

Safe-harbour for good-faith research. We will not pursue legal action against, or report to authorities, researchers who:

• Make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
• Only interact with accounts they own or have explicit permission to test.
• Give us a reasonable window (we ask for 90 days) to remediate an issue before disclosing it publicly.
• Don't exploit a vulnerability beyond the minimum necessary to confirm it exists.

In scope:

• The production web app at app.finwiseapp.io
• The backend API at api.finwiseapp.io
• The FinWise iOS and Android mobile apps
• This marketing site at finwiseapp.io

Out of scope:

• Third-party services we integrate with but do not operate — Plaid, Yodlee, GoCardless, Gathr, Stripe, OpenAI, Heroku, Sentry, Intercom. Please report issues in those services directly to the provider.
• Social-engineering of FinWise staff, customers, or contractors.
• Physical attacks against FinWise infrastructure or offices.
• Denial-of-service (volumetric or rate-based) testing against production.
• Reports generated solely by automated scanners with no demonstrated impact.

What to expect from us. We aim to acknowledge reports within 3 business days, give an initial assessment within 10 business days, and keep you updated as we work on a fix. We do not currently operate a paid bug-bounty programme; we will, however, credit researchers in release notes (with permission) and are happy to help with responsible-disclosure publication timing.

Got a question? Get in touch, we're always happy to help and answer any questions you might have.