Security

Last updated 8 August 2026

Xfin handles bank data, so this page states what we actually do rather than reassurances. If something here stops being true, it gets corrected.

The architecture is the main control

Your financial records are stored on your device, not on our servers. That is a security decision as much as a privacy one: a server that never holds your transactions cannot leak them. Our server holds your profile, your notification settings, your bank access token and an optional encrypted backup, and that is close to all of it.

Bank credentials

We never see them. You enter them into Plaid's own interface. Xfin receives an access token, never a username or password, and that token is kept server-side and never sent to your device.

In transit and at rest

All network traffic uses TLS. There is no unencrypted endpoint.
Server data sits behind row-level security, so one account cannot read another's rows even if application code is wrong.
Secrets and tokens are held in the iOS Keychain on device, not in plain preferences.
Optional cloud backup is encrypted before it leaves your phone.

Getting into your account

Sign in with Apple, so we never hold a password for you.
Optional Face ID or Touch ID lock, which re-locks when you leave the app.
Rate limiting and audit logging on the account system to catch abuse.

The assistant

Questions to Fin are sent with a redacted summary rather than your raw history, and identifiers are stripped before the request leaves your device. Your financial data is not used to train any model. Fin cannot move money: it has no payment capability of any kind, and every change it proposes waits for you to confirm.

Xfin does not move money

This matters for more than reassurance, so it is worth being exact. Xfin never originates an ACH entry or any other payment. It has no payment capability at all, and no feature that could acquire one by accident.

We request read access only. We do not use Plaid Auth or Plaid Transfer, which means we never receive your account or routing numbers. Xfin reads a copy of transactions your bank has already posted.

Because we originate nothing, Xfin is not an ODFI, an Originator, a Third-Party Sender or a Third-Party Service Provider under the Nacha Operating Rules, and the 2026 ACH fraud-monitoring requirements do not apply to it. If that ever changes, this page changes first.

What we do not claim

We are a small team. We hold no SOC 2 report and no ISO 27001 certificate, and we would rather say so than imply otherwise. What we can say is that the app is built so that the most sensitive data never reaches us in the first place.

Reporting a vulnerability

Email security@getxfin.com with enough detail to reproduce it. We will acknowledge within three business days and keep you updated. Please give us a reasonable window to fix it before going public, and please do not access anyone else's data while testing.

We do not currently run a paid bounty, but we will credit you if you would like.