Trust & security
Last updated 8 July 2026
Read-only, always
Fina can see your balances and transactions. It cannot move money, make a payment, or change anything in your bank or investment account — that capability doesn't exist in the app, full stop.
Your bank password never reaches us
You sign in on your bank's own page via Open Banking (OAuth). We receive a revocable access token, never your online banking credentials.
Encrypted where it matters
Bank access tokens and Trading 212 API keys are encrypted (AES-256-GCM) in our database, on top of encryption-at-rest from our hosting provider. All traffic is TLS-encrypted in transit.
No ads, no ad trackers
We don't run advertising pixels, ad-tech analytics, or sell data to third parties. The only cookies are the ones needed to keep you signed in.
Fina uses Open Banking — a UK-regulated standard, not a workaround. When you connect a bank:
Open Banking consent also typically expires automatically after a period (commonly 90 days) unless renewed — this is enforced by your bank/TrueLayer, not something Fina itself tracks or controls.
| Fina can | Fina cannot |
|---|---|
| See your account balances | Move money, make a payment, or set up a transfer |
| See your transaction history | See or store your online banking password or PIN |
| See direct debits and standing orders | Create, cancel, or change a direct debit or standing order |
| See your Trading 212 portfolio (if connected) | Place a trade, withdraw funds, or change your holdings |
| Categorise, analyse, and answer questions about the above | Access any account you haven't explicitly connected |
Trading 212 doesn't use Open Banking — you connect it by pasting in an API key you generate yourself in the Trading 212 app. Fina never asks for a specific permission level; the access that key carries is whatever you chose when you created it. We strongly recommend generating a key with read-only permissions if Trading 212's key settings offer that choice, since Fina only ever needs read access to show you your portfolio. Whatever key you provide is encrypted before it's stored (see below).
| Data | Why | Encrypted? |
|---|---|---|
| Name and email | Your account, via Clerk | Handled by Clerk |
| Bank access tokens / Trading 212 API key | To fetch your data on your behalf | Yes — AES-256-GCM |
| Transactions, balances, categories | The actual product — spending analysis, chat answers | Encrypted at rest by our database provider |
| Chat messages | So Fina has conversation context and you can revisit past answers | Encrypted at rest by our database provider |
Full detail on why each piece of data is collected, who it's shared with, and how long it's kept lives in the Privacy Policy.
Found a security issue or have a question we haven't answered here? Email [email protected] — we'd rather hear about a problem directly than have you guess.