Local-first by default
On the web, Cashflow Pilot keeps app records in local browser storage. On iOS, app records are kept locally on the device. Clearing local storage or uninstalling without a backup can remove that local copy.
Security & data control
Financial software should explain where your data lives.
Cashflow Pilot is local-first by default, does not require online-banking credentials, and treats authentication, backups, exports and deletion as separate controls you can understand.
Security model
Keep the default simple: your financial records stay local.
Cashflow Pilot is designed so you can use the product without handing over bank credentials or creating a cloud account first.
No online-banking credentials required
Cashflow Pilot works from supported statements and exports you choose to import. It does not need your bank password for manual imports. Optional provider connections use separate access tokens or API keys; these credentials should be treated as sensitive.
Authentication is separate from provider data
Where Google or Apple sign-in is used, the provider is used for authentication. Cashflow Pilot does not request Gmail, Google Drive, Calendar or Contacts access just to sign you in.
Passwordless email avoids stored passwords
Email sign-in is designed around short-lived one-time codes or links rather than a Cashflow Pilot password that must be stored and protected.
End-to-end encrypted financial Cloud Sync
When enabled, Cashflow Pilot encrypts your financial records on your device using AES-256-GCM before uploading them. Our cloud stores ciphertext and cannot decrypt those records. HTTPS/TLS and encryption at rest add extra protection. Account email, sign-in, session, device and administrative metadata are handled separately.
Only you hold your recovery secret
Your 43-character recovery secret unlocks synchronized financial records on another device. Cashflow Pilot cannot recover the secret, and email sign-in codes cannot replace it. Save your secret and keep an independent full backup. If the secret is lost, do not erase the last usable local copy. With no secret and no usable copy or backup, your encrypted cloud records cannot be recovered. Read the recovery-secret guide →
Optional bank connections
What bank connections can access, and where the data goes.
Connecting an institution is optional. Cashflow Pilot supports manual imports without linking a bank. These provider connections are read-only for balances and transactions; they do not authorize Cashflow Pilot to move money. Read-only access can still expose sensitive account and transaction details, so provider access tokens must be protected.
SimpleFIN Bridge & Lunch Flow Bridge
Cashflow Pilot's Bank Sync uses a common SimpleFIN-compatible protocol for both SimpleFIN Bridge and Lunch Flow Bridge. A separate Lunch Flow Personal REST API connection may be used for supported investment holdings. Each provider has its own data handling, availability and policies: do not assume Lunch Flow uses SimpleFIN's MX retention practices. How bank connections work →
Who can hold your bank login?
For SimpleFIN Bridge, SimpleFIN says bank credentials, where required, are provided to its connectivity provider MX and do not reach SimpleFIN's servers. Some institutions may offer authorization flows instead of credential sharing. Cashflow Pilot does not ask you to enter an online-banking password into its financial records. SimpleFIN security policy ↗
Cashflow Pilot's connection relay
When you connect or refresh, the signed-in app sends a provider-specific access URL or token to an authenticated Cashflow Pilot Worker over HTTPS. The Worker uses that credential to make a request to an allowlisted provider, reads the response to validate and normalize balances or transactions, and returns the requested data. These requests are not end-to-end encrypted against the Worker. Our implementation is designed not to save provider access URLs, raw bank passwords or raw upstream responses to its database, logs or financial backups. Reviewed/imported transactions become Cashflow Pilot financial records and can be included in encrypted Cloud Sync.
How we save a connection
Don't save (default): keep the access credential in the app's current session memory only. This device: explicitly save it in the iOS Keychain or a passphrase-encrypted AES-256-GCM browser vault. Encrypted sync: explicitly save a verified credential in a separate, owner-only end-to-end encrypted vault, restored after unlocking your recovery secret on another device. Encrypted cloud connection storage is separate from ordinary financial-record sync and backups. Choosing Don't save does not erase previously saved copies.
Provider retention and incident history
SimpleFIN's Privacy Policy (effective October 27, 2026) ↗ says SimpleFIN Bridge itself does not retain banking data; MX retains account and transaction data while a connection is active, potentially indefinitely, and removes related MX data within two weeks after the provider account or connection is deleted. SimpleFIN also disclosed a May 28, 2026 incident ↗: a four-hour MX account-mixing bug could have exposed account names, balances and transactions between up to 39 users. SimpleFIN reports that bank login credentials were not exposed.
Removing access is more than deleting a saved key
Disconnecting within Cashflow Pilot, deleting a device-vault credential, or deleting an encrypted cloud copy only affects those copies; none of those actions alone revokes provider access or removes financial records you already imported. To stop future access, revoke the SimpleFIN/Lunch Flow connection or token with that provider and, where appropriate, disconnect the institution with your bank. Separately remove saved credentials from each device and encrypted sync, and manage imported Cashflow Pilot records or backups if you also want those deleted. Provider data-deletion timelines vary.
Use a bank-authorized flow when offered. Enable MFA at your financial institution and on the bridge account, choose only accounts you need, verify imported transactions, and never send setup tokens, access URLs, passwords or MFA codes to support. Security incidents and third-party practices can change; review SimpleFIN Security and SimpleFIN Privacy before connecting. Provider policies are independent of Cashflow Pilot's promises.
See the difference
Readable on your device. Unreadable in our cloud.
Here is a fictional transaction encrypted with the same AES-256-GCM envelope format used by Cashflow Pilot. The example was encrypted and successfully decrypted using a demonstration key; it is not an actual customer record.
On your unlocked device
Your device can show transaction details after you unlock your data.
Date: 2026-10-24 Merchant: Example Grocery Store Amount: -$42.75 CAD Category: Groceries Account: Example Chequing
Stored in the cloud database
The financial record is ciphertext. The database can see opaque identifiers, revision and operation metadata, but not the amount or merchant.
record_token:
rec_iKItQ_2oylkyPzyyKxMBO8PhfhYKcxnJphpYpPgn8wE
revision: 1
operation: upsert
key_version: 1
encrypted_json:
version: 1
algorithm: A256GCM
nonce: omDeK4DwAY0UKPw7
ciphertext:
AJp4liJ0V4N_o1AxpOKkHUtmRqhZUM8O…
(encrypted bytes continue)See the complete example ciphertext
AJp4liJ0V4N_o1AxpOKkHUtmRqhZUM8OKP_YV1488hKYS0-I_gRhUE-HcS5tOc9XSWkoBWaLWBkEV9lhaNWOIg-to8BcCTIUFdFfWXh4-2q7OcNpSoUg4PlmaUqHrk1bUxR6ZZSf5kTEx9fw5PqpnTIGcjcBqBepug8BENXxnL7H8EILBsTYAvIgKjPS3uZY0HIRg2VsqfXtCzOLFi-ajyEJZCxYD7Mq-8t_KRJqoqotLFPMvIvpaWgkTkC-cappIMXOV3Pd_r2i1H_-UHRDGm6zxXCOf3m7SMqGNbxEkYsXEjQUGu82b7_I02nb5oS1jTkd1QY8nqeVqDWUgSd7nlzNaJTVPcdkhgrhmd8VG-NZ2O_eVg3dPgSPIKyYipTkkj7dLcKH6PjoIVP9Ttzle6zyNxQfn__SM2HgYKtxR26zxI57hwIi2HWAB7kfE4uOJK33rTGYXrU3dFPZsTqXT5VR2PRvfgu-fXR3zj28bPTc9K7yQvYjV-iYYX0fGdTlyUCRXlfY2wuMWAIn the real database, encrypted_json is a TEXT field containing the full JSON envelope, including the nonce and ciphertext. Your readable description, date, amount, currency, category and account association are inside that encrypted payload. The server does retain account identity, opaque record tokens, timestamps and sync metadata. Optional bank-provider requests and customer-provided support files are separate from financial Cloud Sync encryption.
Your control
Portability and deletion are part of security too.
Backups and exports
Use Cashflow Pilot's backup and export tools before clearing browser data, reinstalling, moving devices or making major changes. Exported files are yours to store and protect.
Cloud features are opt-in
Cashflow Pilot is usable locally without enabling Cloud Sync. Turning on an account feature is a separate choice from starting to use the financial workspace.
Delete account & cloud data
Where a Cashflow cloud account is enabled, the account settings include a server-side deletion path. Keeping or erasing the local device copy is treated as a separate choice.
Support does not need your raw files by default
Do not email statements or financial exports unless support specifically asks for them and you are comfortable sharing the information they contain.
Your privacy rights
Where PIPEDA applies, you can request access to personal information Cashflow Pilot holds about you, ask how it has been used or disclosed, request appropriate corrections, and challenge our privacy compliance. Read your privacy rights under PIPEDA →
Security also depends on the device and browser you use. Protect device passcodes, browser profiles, backups, downloaded statements and exported Cashflow files just as you would other financial records.
Have a security or privacy question?
Contact Cashflow Pilot directly rather than sending sensitive records unprompted.
Sharing without surrendering your key
The owner chooses what another person may decrypt.
Encrypted financial Cloud Sync remains private. Approved sharing uses recipient-specific encryption, a separately verified identity, and explicit owner selection—not the owner's recovery secret. The recipient signs into their own account and unlocks their own key.
Spouse: only selected Personal or Portfolio details
A consent-only invitation is not a data grant. In the private-gated snapshot workflow, the owner previews and publishes specifically chosen records. Earlier snapshots do not become a live all-account view.
Accountant: separate Business scope and approvals
Limited encrypted journal and pending-bank category proposals require explicit owner consent and validation. Payroll, employee identity documents and unrestricted books do not automatically become available.
Revocation stops future access—not past knowledge
Expired or revoked permission prevents further authorized reads, but cannot erase information a recipient already viewed, copied or downloaded. Cloud access also requires administrator activation where the sharing feature is privately gated.