Data Security

How Zerosum protects your financial data: encryption in transit and at rest, secure sign-in, bank connection security, what we never track, and the controls you have.

Written By Pedro

Last updated 18 days ago

Zerosum protects your financial data with encryption in transit and at rest, secure sign-in, read-only bank connections, and no tracking. Here's exactly what that means.

How your data is protected

Your financial data is protected at every layer, both while it travels and while it sits in our database.

  • In transit: everything between your device and Zerosum travels over TLS, so it's never sent in readable form.
  • At rest: your data is encrypted at rest, covering our database and every backup.
  • Bank keys: the keys for your bank connection get a second layer of AES-256 encryption inside our database.

How you sign in

You sign in with a password, Apple, Google, or a one-time code sent to your email. Passwords are securely hashed before storage and are never stored in plaintext. You can add or change a password anytime in Settings, and turning on two-factor authentication for an extra check at sign-in requires one.

Your bank login

We never see or store your bank username or password. Your bank connection is handled through our banking partner, and the access it grants is read-only, just your transactions and balances. Nothing can move money. The access keys we hold on your behalf are encrypted in our database, so even a copy of that database wouldn't expose them.

⚠️ Warning: Support will never ask for your bank username, password, or any one-time code. If a message asks for these, it's not from us.

Who can see your data

To build your budgets, categories, and reports, our servers process your transactions, so that data isn't hidden from the app itself. But we don't read it to run the service. The only time we access the data in your budget is when you explicitly ask us to and give consent, for example to help debug a problem you've run into.

Your data is protected by the encryption above, it's never sold, and it's used only to run your budget. See our Privacy Policy for the full detail on how we handle your information.

Cookies and tracking

We don't track you, and other websites can't see what you do inside Zerosum. Your browser keeps every site separate, so no other tab or site can read your Zerosum session or data.

  • Only essential cookies: just the strictly necessary cookies that keep you signed in. No tracking or advertising cookies, so there's no consent banner to click through.
  • Cookieless analytics: the little analytics we run collects no personal data and honors Do Not Track and Global Privacy Control.
  • No cross-site tracking: no Google Analytics, no advertising pixels, no cross-site tracking of any kind. We don't sell your data.

Our Privacy Policy covers cookies and analytics in full, including how to opt out.

Where Zerosum runs

Zerosum runs on Northflank and Cloudflare, built on Google Cloud infrastructure in the United States that holds the standard security certifications, such as SOC 2, ISO 27001, and PCI DSS. Payments are handled by our merchant of record: Polar for subscriptions bought on our website and Apple for subscriptions bought in the iOS app. Your card details go straight to their systems and never touch our servers.

Controls you have

  • Two-factor authentication: add an authenticator code to your sign-in from Account security.
  • Export anytime: download your data whenever you want. See Backups and exports.
  • Delete your account: remove your account and its data for good from Settings.
  • Inactive accounts: if your account has no active subscription and goes unused for 12 months, it is scheduled for deletion. We email you 30 days and 7 days before, and signing in keeps your account.
  • Empty accounts: if you sign up but never finish creating your account, or your account has no trial or subscription, no budget data, and no budgets shared with you, it is deleted after 14 days of inactivity. These accounts hold no financial data, so no separate notice is sent.

ℹ️ Note: Found something that looks off, or want to report a vulnerability? Email [email protected] and it reaches us directly.

Where to next