Security and privacy

Your plan is encrypted

Your plan and any transactions you import are encrypted (AES-256) before they're saved, each with its own key. The key is kept apart from the database. Our server opens your plan only to show it to you, to work out when a reminder is due and, if you choose to share it, for your advisor.

Statements stay on your device

Bank and card statement files (CSV, OFX, QFX or PDF) are read in your browser and never uploaded. Only each transaction's date, description, amount and category are saved, with card and account numbers taken out of the descriptions.

Only what's needed

Truvane never asks for your bank sign-in, your account numbers, or your SIN or Social Security number. You type in your own figures.

Signing in

• Passwords are stored only as bcrypt hashes, never as typed. The most common passwords are refused.
• Your email address is confirmed before your first sign-in.
• Repeated wrong passwords are slowed down.
• The sign-in cookie can't be read by scripts on the page and is sent only over secure connections.
• You stay signed in for 30 days after your last visit. Your Account page lists your devices, with a button to sign out of all of them.
• Changing or resetting your password signs out your other devices and emails you. A reset link works once, within an hour.

Sharing with an advisor

• Your plan is shared only if you turn sharing on.
• Victoria sees your plan, check-ins and reviews, but not the transactions you import, and can't change anything.
• Each time Victoria opens your plan, it's recorded, and the record is in your data download.
• Stop sharing at any time, and access ends at once.

Your data, your choice

• Download a copy of everything from your Account page.
• Deleting your account removes your plan, transactions, feedback, sharing records and sign-ins straight away. Emails already sent can't be recalled.
• Your information is never sold or used for advertising.

No tracking in the planner

Our public website uses Google Analytics to count visits. It's switched off in Truvane and on your account pages, so nothing you enter in your plan is sent to it.

Emails

Account emails are sent through Resend. Check-in reminders come only if you ask for them, never contain your figures, and can be stopped with one click.

Where it runs

The website runs on Vercel, the server on Render behind Cloudflare, and the database on MongoDB Atlas. These providers may store data outside Canada, including in the United States. Every connection is encrypted, and pages are sent with security headers that stop other sites from framing them.

Something wrong?

If you think you've found a security problem, please email hello@yourmoneyally.com. The privacy policy has the rest of the detail.