Security
What we can see, and what we can't.
Short version: your ledger is sealed on your devices and we can't open it. A few features you switch on yourself, like connecting a bank, mean we hold something for you. Here is every one of them.
Your ledger and everything you sync We can't read it
Accounts, transactions, budgets, bills and notes are sealed on your device before they leave it. The live relay forwards them between your devices without storing or logging them. So a device that was offline can catch up, the relay also keeps sealed copies: the newest one, plus older ones for up to 90 days. It can't open any of them, and we never hold the key.
Who you share with Coming
Shared ledgers are coming. When they arrive, this card will say exactly what the server can and can't see about who's in.
Bank and mailbox connections We hold it, sealed
If you connect a bank or a mailbox, the relay keeps the access token so it can fetch new transactions or receipts for you. That token is encrypted at rest and is never sent back to the app. It is not end-to-end encrypted, because the relay has to use it. This is the one place we are a custodian on purpose, and it's limited to the connections you choose to make.
Receipts you email in We hold it, for a while
Receipts you forward to your SumMoney address are held where the server can read them, so they can be matched and filed. They're kept for up to 60 days, or up to 90 days while they come from a sender you haven't approved yet, and only purchase receipts and invoices belong there.
Your card Coming
How you'll pay is being settled before launch. Whatever it is, SumOne never holds your money, and this card will say exactly what we keep.
Deleting your account Gone
Erasing your account removes everything we hold server-side for it: connection tokens, held receipts, sharing logs and sealed snapshots. The data on your own devices is yours to keep or delete.
The waitlist We hold it
If you join the waitlist we keep your email, and your answers about device and region if you gave them, so we can write to you. Every email has a link that deletes the lot.
These websites Nothing
No cookies, no trackers, no third-party scripts or fonts. We count page views as one daily total per page, without recording who you are or where you came from.
How we keep ourselves honest
The list of everything our servers store, and how each piece is protected, is a file in our code. A test fails the build if anyone adds a stored credential without declaring it there, or if the live sync relay ever gains storage or logging. The wording on this page is checked against that same file.
Found a security problem? Email support@sumone.app and we'll get back to you.