Your financial data deserves bank-level protection.

1. Finora never sees your bank login credentials

When you connect a bank account, you authenticate directly with your bank through Plaid — the same connection service that Venmo, Coinbase, Robinhood, and thousands of banks use. Your username and password never touch Finora's servers.

Plaid passes us a long-lived access token (not credentials) that lets us read your transactions and balances on the accounts you authorized. You can revoke that access from your bank or from Finora's account hub at any time.

Learn more about Plaid's security model at plaid.com/safety.

2. Encryption — in transit and at rest

• In transit: every request to Finora uses TLS 1.3. Modern HTTPS, the same standard your bank uses.
• At rest: your data lives in a Supabase Postgres database encrypted with AES-256. Hosted on infrastructure with SOC 2 Type II compliance.
• Row-level security: every database query is gated by your household. Even if another user triggered a query for your data by mistake, the database would refuse to return it.

3. Two-factor authentication, required before banks

Before you can connect any bank account, Finora requires you to set up TOTP-based two-factor authentication. That means a 6-digit code from an authenticator app, in addition to your password.

We support any standard TOTP app — including free options like Google Authenticator, Microsoft Authenticator, Authy, Duo Mobile, and your iPhone's built-in Camera (iOS 15+).

Even if someone gets hold of your password, they can't connect a bank or view your transactions without your second factor.

4. What we track — and what we don't

What we do

• Read your transaction descriptions, amounts, and dates so we can categorize spend, find HSA-eligible expenses, flag wrong-card purchases, and detect business trips.
• Store your data encrypted on secure servers in the United States.
• Log security-sensitive actions you take (sign-in, MFA changes, bank connection) so you can audit your own account activity.

What we don't

• Sell your data to advertisers or third parties. Ever. Not in beta, not after launch. Our revenue comes from the subscription, not your data.
• Have the ability to move money, make purchases, or modify your bank accounts. Plaid grants us read-only access. The connection cannot transfer funds — it's technically impossible for us to do so.
• Store your bank login credentials. They never touch our servers (see §1).
• Share data with employers or family members unless you explicitly add them to your household.

5. Your data, your control

• Export anytime. Download all your data as JSON or CSV from Settings — no waiting, no support ticket.
• Delete anytime. Request full account deletion and we remove every row within 30 days. Includes transactions, household members, trips, and audit log entries.
• Disconnect any bank instantly. One click in Account Hub. We delete the Plaid access token immediately and stop syncing.

6. Audit trail

Every sensitive action on your account — sign-in, MFA enrollment, bank connection, data export — is recorded in an append-only audit log. We never modify or delete those entries.

You can review your own security activity at any time in Settings → Security. If you see a sign-in you don't recognize, you'll know immediately.

7. Questions about our security practices?

Email trust@finora.app. We answer every message and we don't hide behind corporate-speak. If something here is unclear or you have a concern, write to us.