Encryption

Everything between you and Finralis is encrypted over HTTPS. Passwords are stored only as salted hashes, never in plain text. Sensitive secrets, like two-factor keys, are encrypted with a key that's never stored in the database.

Signing in

• Turn on two-factor authentication with any authenticator app from Profile → Sign-in & security, with one-time backup codes in case you lose your phone.
• Changing your email, turning two-factor on or off, exporting your data or deleting your account asks for your password again, even mid-session.
• Changing your password needs your current one, and signs you out everywhere else.
• Sign-in attempts are rate-limited to slow down password guessing.
• We email you when your account is signed into from a new device.

Bank & investment syncing Coming soon with Plus

Syncing will run through Plaid, a widely used financial data provider. You sign in to your bank in Plaid's window, so your bank credentials never reach Finralis. Access is read-only: Finralis can't move money in or out of your accounts. You'll need a verified email and two-factor authentication before you can connect an account, and disconnecting one revokes its access.

Your data

Your financial data is yours. We never sell it or use it for advertising. You can download all of it, or permanently delete your account, from Profile → Account. See the Privacy Policy for details.

Report a security issue

Found a vulnerability? Email Info@Finralis.com with the details. We take every report seriously and will reply as quickly as we can.