Your financial data is sensitive, and we take its protection seriously. Here's how we keep your information safe.
1. Encryption
We use strong, industry-standard encryption to protect your data:
In Transit: All data transmitted between your device and our servers is encrypted over HTTPS (TLS)
At Rest: Your data is stored in MongoDB Atlas, which encrypts stored data at rest (AES-256)
WhatsApp Messages: Messages travel over WhatsApp's encrypted transport. Once received by MoneyFeed through our messaging provider (Twilio), their contents are processed to extract your transactions and then stored securely
2. Infrastructure Security
Our infrastructure is built on reputable, security-focused cloud providers:
Hosted on managed cloud infrastructure (MongoDB Atlas and our application platform) whose providers maintain SOC 2 compliance
Automated monitoring and access controls at the infrastructure level
Managed, redundant backups handled by our database provider
DDoS protection and TLS provided by our hosting and CDN layer
3. Compliance
We design MoneyFeed to respect international data-protection rights:
GDPR
We honor GDPR rights for EU users, including access, export and deletion of your data
CCPA
We honor CCPA rights for California users, including access and deletion, and we do not sell your data
4. Access Controls
We limit who can access your data:
Access to user data is restricted to authorized personnel who need it to operate the service
Every account's data is scoped to its owner — users can only access their own records
Accounts are protected by phone-number verification and a PIN stored only as a bcrypt hash
Authentication endpoints are rate-limited to help prevent abuse
5. Data Retention & Deletion
You have control over your data:
Active Accounts: Data is retained as long as your account is active
Account Deletion: When you delete your account, all personal data is permanently removed within 30 days
Export: You can export all your data at any time from Settings
Inactive Accounts: Accounts inactive for 2+ years may be deleted after notification
6. Incident Response
In the unlikely event of a security incident:
We investigate suspected security incidents promptly
If a breach affects your personal data, we aim to notify affected users within 72 hours, in line with GDPR
We take steps to remediate the issue and prevent recurrence
7. Questions or Concerns?
If you have any questions about how we protect your data, please contact us: