Short, honest answers about your keys, your banks and your bill — including the parts that are less convenient than we would like.
Yes — but it works differently from an API key, and it is deliberately destructive.
An API key is a credential we hold, so we can mint a new one and revoke the old one in a second. Your encryption key is not like that. The private half is generated inside your browser and never reaches us; we only ever hold the public half, which is enough to encrypt data for you and never enough to read it. There is nothing on our side to re-issue.
So rolling it means replacing the whole pair. Everything already stored under the old public key stays sealed to a private key that no longer exists — permanently, on every device — which means reconnecting your banks and pulling your history again from scratch. As a security precaution, rolling the key also revokes every API key on your account at the same moment.
The flow lives on the “This device doesn’t have your key” screen, under “Don’t have your key? Reset and start over”. To reach it on purpose: log out, clear this site’s storage in your browser (or open a fresh browser profile), log back in, and choose “Reset and replace my key”. If you drive us over the API instead, generate a new P-256 key pair and PUT the new public key to /api/keys/me — the consequences are identical.
If you would rather not do it alone, write to [email protected] and we will walk through it with you.
We cannot recover it, and that is the point of the design. Your passphrase never leaves your device — it wraps the private key held in your browser, and we never see either one.
If the key still exists on a device you can reach, unlock it there and export it from the Developers page, then import the file on the device you are locked out of. If it is gone everywhere, the data encrypted under it is unreadable for good and the only way forward is to replace the key and sync your banks again.
Sign in on the new device and it will tell you it doesn’t have your key. On a device that already works, open the Developers page and export your key file. Paste or upload that file on the new device and choose a passphrase for it — each device wraps the same key under its own passphrase.
The import is checked against the public key on your account, so the wrong file is rejected outright instead of quietly leaving the device unable to read anything.
No. Everything we store for you is sealed with your public key before it is written, and only the private key in your browser can open it again. Your bank login never touches us at all — you authenticate at your bank’s own site.
What we can see is the account-level metadata we need to run the service: your email, your billing state, and when a sync ran. The full architecture is on the security page.
No — and that follows from the encryption rather than being a limitation we chose. The identifier we need in order to talk to your bank is itself sealed under your key, so a sync can only start where that key is available: your browser while you are signed in, your own API client, or the CLI.
Opening the app syncs automatically, you can sync on demand from the Accounts page, and you can drive it yourself with the API and SDKs.
PSD2 puts an expiry on the consent you give your bank, and most banks set it to 90 days. Once it lapses we cannot fetch anything new until you re-approve at the bank. We email you before it happens and show a banner in the app.
Reconnecting keeps everything already synced — it never starts you over.
On the first sync we ask for about two years and negotiate downwards if the bank refuses, with a floor of 90 days — the minimum PSD2 guarantees. What you actually get is the bank’s decision: some hand over several years, some stop at 90 days. You can see each bank’s consent rules on the supported banks page.
After that, every sync is incremental and additive. We never delete transactions we have already stored for you.
Yes. A bank consent usually covers more accounts than you actually want. On the Accounts page you can permanently remove the ones you don’t need, and they stop counting towards your bill from the next month.
Removing an account also deletes the data imported for it, and it cannot be undone.
€3 per month covers your first connected account, plus €1 per month for each additional one, VAT included. Fees are drawn from a small prepaid wallet, and part-months are prorated, so you are never billed ahead for accounts you don’t have.
You only pay for accounts with a live bank connection. Proration, auto-pay and the refundable wallet buffer are all spelled out in how billing works.
The monthly fee goes to zero and the data you already have stays viewable for free.
Any unused wallet balance is still your money: write to [email protected] and we refund it, free of charge. If you want the data gone as well, see deleting your account.
Create a new key on the Developers page, move your integration across, then revoke the old one. A key is shown once, at creation, so store it when you make it.
Note that replacing your encryption key revokes every API key at once — if you have just done that, expect to mint fresh ones. The clients that consume them are on GitHub.
Settings has a danger zone that permanently deletes the lot: bank connections, accounts, transactions, balances, API keys and the public key we hold for you. You confirm by typing your email address. On the way out your browser also closes each consent at the bank itself, and the key stored locally is wiped.
It is irreversible and there is no export afterwards, so take your CSV or PDF export first if you want to keep anything.
Write to [email protected]. A person reads it, and questions that come up twice end up on this page.