Short, honest answers about your keys, your banks and your bill — including the parts that are less convenient than we would like.
Yes — but it works differently from an API key, and it is deliberately destructive.
An API key is a credential we hold, so we can mint a new one and revoke the old one in a second. Your encryption key is different: the private half is generated inside your browser and never reaches us, and we only ever hold the public half, which is enough to encrypt data for you and never enough to read it. There is nothing on our side to re-issue.
So rolling it means replacing the whole pair. Everything already stored under the old public key stays sealed to a private key that no longer exists — permanently, on every device — so you reconnect your banks and pull your history again from scratch. **Settings → Replace your encryption key** does the whole job in one step: it disconnects every bank and closes each consent at the bank, deletes the accounts, balances and transactions we hold for you, and then installs the new key. Your API keys keep working, and so do your billing history and the account itself.
You can also bring your own key rather than let us generate one. Paste a P-256 private key as JWK, PKCS#8 or PEM, or the credentials file you exported from the Developers page. Before anything is destroyed we prove that key works: our server encrypts a random value to it, and your browser has to open it again. Rolling the key needs a signed-in browser session — an API key cannot do it, by design.
The older path on the “This device doesn’t have your key” screen is still there for a key that is genuinely lost. It cannot tell a lost key from a deliberate change, so it takes the cautious route: it revokes every API key on your account, and it cannot close your bank consents, because only your browser can read their identifiers. Prefer Settings when the choice is yours.
If you would rather not do it alone, write to [email protected] and we will walk you through it.
We cannot recover it, and that is the point of the design. Your passphrase never leaves your device — it wraps the private key held in your browser, and we never see either one.
If the key still exists on a device you can reach, unlock it there and export it from the Developers page, then import the file on the device you are locked out of. If it is gone everywhere, the data encrypted under it is unreadable for good and the only way forward is to replace the key and sync your banks again.
Sign in on the new device and it will tell you it doesn’t have your key. On a device that already works, open the Developers page and export your key file. Paste or upload that file on the new device and choose a passphrase for it — each device wraps the same key under its own passphrase.
The import is checked against the public key on your account, so the wrong file is rejected outright instead of quietly leaving the device unable to read anything.
No. Everything we store for you is sealed with your public key before it is written, and only the private key in your browser can open it again. Your bank login never touches us at all — you authenticate at your bank’s own site.
What we can see is the account-level metadata we need to run the service: your email, your billing state, and when a sync ran. The full architecture is on the security page.
No — and that follows from the encryption rather than being a limitation we chose. The identifier we need in order to talk to your bank is itself sealed under your key, so a sync can only start where that key is available: your browser while you are signed in, your own API client, or the CLI.
Opening the app syncs automatically, you can sync on demand from the Accounts page, and you can drive it yourself with the API and SDKs.
PSD2 puts an expiry on the consent you give your bank, and most banks set it to 90 days. Once it lapses we cannot fetch anything new until you re-approve at the bank. We email you before it happens and show a banner in the app.
Reconnecting keeps everything already synced — it never starts you over.
On the first sync we ask for about two years and negotiate downwards if the bank refuses, with a floor of 90 days — the minimum PSD2 guarantees. What you actually get is the bank’s decision: some hand over several years, some stop at 90 days. You can see each bank’s consent rules on the supported banks page.
After that, every sync is incremental and additive. We never delete transactions we have already stored for you.
Yes. A bank consent usually covers more accounts than you actually want. On the Accounts page you can permanently remove the ones you don’t need, and they stop counting towards your bill from the next month.
Removing an account also deletes the data imported for it, and it cannot be undone.
€3 per month covers your first connected account, plus €1 per month for each additional one, VAT included. Fees are drawn from a small prepaid wallet, and part-months are prorated, so you are never billed ahead for accounts you don’t have.
You only pay for accounts with a live bank connection. Proration, auto-pay and the refundable wallet buffer are all spelled out in how billing works.
The monthly fee goes to zero and the data you already have stays viewable for free.
Any unused wallet balance is still your money: write to [email protected] and we refund it, free of charge. If you want the data gone as well, see deleting your account.
Create a new key on the Developers page, move your integration across, then revoke the old one. A key is shown once, at creation, so store it when you make it.
Replacing your encryption key from Settings leaves your API keys alone — they keep working. The older reset on the “This device doesn’t have your key” screen does revoke all of them at once, so if you have just been through that, expect to mint fresh ones. The clients that consume them are on GitHub.
Settings has a danger zone that permanently deletes the lot: bank connections, accounts, transactions, balances, API keys and the public key we hold for you. You confirm by typing your email address. On the way out your browser also tells each bank to end its sharing permission — when it can. If your key isn't unlocked at that moment those permissions run out on their own instead. The key stored locally is wiped either way.
It is irreversible and there is no export afterwards, so take your CSV or PDF export first if you want to keep anything.
Write to [email protected]. A person reads it, and questions that come up twice end up on this page.