Financial data deserves bank-grade handling. Here is exactly how MoneyLens protects it.
Encryption
AES-256-GCM encryption at rest for sensitive fields
TLS 1.2 or higher enforced for all traffic
Strict transport security, content security policy and related headers on every response
Access control
Row-level security so a user can only ever read their own rows
Roles stored separately from profiles to prevent privilege escalation
Multi-factor authentication available on all accounts and required for high-risk changes
Full audit trail of edits, reverts, bank reconnects, refreshes and deletions
Bank connections
Bank logins are entered inside Plaid, never in MoneyLens. We request read-only access to transactions and balances only — never payment initiation. You can disconnect a bank at any time, which removes its accounts and transactions.
Privacy
MoneyLens is aligned with PIPEDA and GDPR. Data is not sold, and consent for analytics and marketing cookies is explicit opt-in.