Security

Nosy is nosy about your money so that nobody else gets to be. Here's how we protect it.

Signing in

• Every sign-in needs a one-time code sent to your email. We don't use passwords.
• No account can be linked without a verified session and your recorded consent.
• Codes expire after 10 minutes and work once, and repeated wrong tries use a code up.

Your bank login

You link accounts through Plaid. We never see or store your bank username or password.

Encryption

• All traffic uses HTTPS with TLS 1.2 or higher.
• Data at rest is encrypted with AES-256 using AWS KMS.
• Plaid access tokens are additionally encrypted at the application layer.

Your data, your call

Disconnecting an institution revokes our access and deletes its data right away, and you can delete everything at once in Settings. We don't sell your data. See our Privacy Policy.

AI

Nosy sorts transactions with an AI model on Amazon Bedrock. It sees merchant names, the bank feed's category and whether money went in or out. It never sees amounts, account names or account numbers.

Keeping it patched

The app runs on managed AWS infrastructure. Dependencies are monitored for known vulnerabilities, and code is scanned automatically for security issues and leaked secrets.

Reporting a problem

If you think you've found a security issue, please tell us privately so we can fix it. Questions or requests: use the contact details provided with your account.