Three pillars of protection.
Every layer of Trakvance is built with your security as the top priority. These aren’t bolt-ons — they’re how the product works, by design.
We never see your password.
When you connect your bank, you log in through a regulated SOC 2 Type II financial data provider — the same infrastructure Venmo, Cash App and Robinhood use. Your credentials go to them. We never see, store, or touch your password.
Read-only. Always.
The connection Trakvance has to your bank is read-only by design. We can see transactions. We cannot move money, initiate payments, or change anything about your account. Ever.
Military-grade encryption.
Your access tokens are encrypted with AES-256-GCM — the same standard banks and governments use. The encryption key lives in a separate vault from your data. Even if our servers were compromised, attackers would find only ciphertext.
The checklist.
Every measure, verified.
We don’t mark ourselves for homework. Each of these is monitored continuously — encryption coverage, token security, infrastructure hardening, audit logs.
How the bank connection works.
No magic. When you connect your bank, here’s every hop your credentials and data actually take — and where they never go.
Your password never touches our servers.
Your bank login happens on a secure, regulated third-party page. Trakvance only ever receives a read-only access token — and that token is encrypted the moment it arrives.
You log into your bank
On a regulated, SOC 2 Type II provider's page — not on Trakvance's servers. Your password goes directly to them.
A read-only token is issued
The provider hands us a narrow, read-only access token. No password, no write access, no money movement.
Token is encrypted immediately
AES-256-GCM encryption runs before it touches our database. The key lives in a separate vault.
Transactions sync automatically
We receive webhook updates on every new transaction. Stored encrypted on US-based servers with row-level security.
You stay in control
Disconnect anytime from Settings. Connection removed immediately, all associated data deleted within 24 hours.
Certifications & compliance.
Industry-standard protections, verified by independent audits and aligned to the frameworks you expect from financial infrastructure.
You’re always in control.
Connecting your bank isn’t permanent. You decide what data we hold, how long we hold it, and when it’s gone. Our commitments are explicit.
What you can do
- check_circleDisconnect your bank anytime — from Settings → Connected Banks. The link drops immediately.
- check_circleDelete your account and all data instantly — transactions, tokens, AI chat history, everything.
- check_circleExport your full history — CSV, PDF, or JSON, on demand.
- check_circleSee exactly what we have — a single page lists every piece of data tied to you.
What we’ll never do
- cancelNever sell your data to brokers, advertisers, or anyone else. Our revenue comes from you.
- cancelNever train AI models on your personal transactions. Your data is yours.
- cancelNever move money on your behalf. Our connection is read-only — we couldn't even if we wanted to.
- cancelNever share without consent — not with partners, marketers, or third parties.