You’re about to connect your bank, so here is exactly what happens.
No vague reassurance about bank-grade encryption. What we can see, what we cannot do, where it lives, and what we can actually evidence.
- Bank accessRead-only
- Two-factor sign-inRequired for owners, admins and accountants
- CertificationsNone yet
- Penetration testNot yet
Bank connections use the GoCardless Bank Account Data API, which is an account information service only. It grants access to your account list, balances and transaction history, and carries no payment initiation capability at all. There is no instruction we could send that would move a penny, because the connection has no mechanism for one.
You authenticate with your bank directly, through their own screens. Credentials never touch our systems, and we could not retrieve them if we wanted to.
From the app or from your bank. Access ends immediately and the history already imported stays in your records. Deleting that history is a separate step you choose to take.
We do not sell your data or share it with advertisers. Revenue comes from subscriptions, which is the only arrangement where our interests and yours point the same way.
Isolation enforced in the database itself.
Most security pages describe intentions. These are mechanisms, and each one is checked by the build.
Every table is governed by PostgreSQL row-level security, so one account cannot read another's rows even if application code were to ask for them. The database itself enforces that separation, below the application code.
Anything that needs elevated permission runs in an audited edge function on the server, with a registry of what may use service-role access. None of it sits in code shipped to your browser.
Bank tokens, HMRC credentials, names, balances, amounts, transaction descriptions and National Insurance numbers are on an explicit never-log list, enforced by a shared logging helper with regression tests.
Secret scanning, a sensitive-logging guard, row-level-security proofs, schema-usage proofs and a service-role registry check all run in CI. A change that breaks one of them does not ship.
A code from your authenticator app at sign-in.
On Financial IQ Business, owners, admins and accountants must set up an authenticator app. Anyone opening the VAT and HMRC screens needs it too. Backup codes and trusted devices keep it workable day to day.
An explicit list, enforced by tests.
Logging is where financial data usually leaks, because nobody means to do it. These values are on a never-log list with a shared helper and regression tests behind it.
- Bank provider tokens
- HMRC credentials and tokens
- Service-role and payment provider secrets
- Names, emails and addresses
- Account numbers and balances
- Transaction descriptions and amounts
- Tax values and National Insurance numbers
The specifics
Everything here should be checkable. If a row cannot be evidenced, it does not belong on the page.
What happens to a Business company’s data after it cancels.
- 0190 days, read-only
When a Business company cancels, it stays readable for 90 days so you can check figures and take what you need. Nothing new can be posted.
- 02Then app access ends
After the 90 days, the company can no longer be opened in the app.
- 03A seven-year encrypted snapshot
An encrypted snapshot of the company's records is kept for seven years.
- 04Early deletion, with 14 days to change your mind
You can ask for deletion sooner. Once the request is verified, a 14-day cooling-off period runs before anything is deleted.
Who else touches your data
Every company we rely on to run the product, what each one is for, and where it processes. We give notice before this list changes.
Database, sign-in, file storage and server functions
Hosting, content delivery and request logs
Read-only open banking connections to your bank
Subscription billing and card payments
Reads uploaded documents such as receipts and bills, and helps categorise transactions
Sign-in links, invitations and notification email
Checks a new password against known breaches. Your browser sends the first five characters of a hash, never the password itself
Reads your public IP address, which HMRC requires inside the fraud prevention headers on any tax submission
These receive data only because you instructed us to send it. Neither handles data on our behalf.
Tax submissions, obligations and the fraud prevention data HMRC requires with them
Company lookup, and statutory filings where you choose to make them
Found something? Tell us.
We will acknowledge it, keep you updated, and credit you if you want it. We will not threaten you with lawyers for reporting a bug in good faith.
Report it here