Security
We describe what we actually do rather than making claims we have not earned. Below is the real picture, including what we do not have yet.
Bank connections run through Plaid. Your banking credentials go to your bank, never to FightMyFees. The connection can read transactions and nothing else — it has no ability to move money, and you can revoke it at any time.
The token that lets us read your transactions is encrypted with AES-256-GCM before it is stored. The encryption key lives in the server environment, never in the database, so a copy of the database alone is not enough to use it.
Every database read is scoped to the account that made the request, enforced in a single data layer rather than route by route. Your transactions, vendors, and documents are never pooled with another customer's.
Uploaded statements are written outside the public directory with restricted file permissions and randomly generated names. They are not addressable by URL — the only way to retrieve one is through a request that proves you own it.
Sign-in sessions are stored server-side and can be revoked. Session cookies are HTTP-only and same-site, so page scripts cannot read them. Passwords are hashed with scrypt and are never stored or logged in a readable form.
When we read a statement, merchant IDs and account numbers are reduced to their last four digits. We do not need the full number to negotiate, so we do not keep it.
FightMyFees does not currently hold SOC 2, ISO 27001, PCI, or HIPAA certification. Plenty of companies our size imply otherwise with phrases like “bank-grade security.” We would rather tell you precisely what we do and let you judge it.
We do not store your bank login credentials, because we never receive them. We do not store vendor portal passwords.
If we pursue formal certification, this page will say so on the day it is true and not before.
You own your transactions, your uploads, and your analysis. You can disconnect an account or ask us to delete your data, and we will. Questions about any of this are welcome — this is exactly the kind of thing you should interrogate before connecting a bank account to anything.
Run My Free Savings Scan