Security

What we do to keep your data yours

Banking data calls for a different level of care. These are the concrete measures, not generic principles.

What happens when you connect a bank

You authenticate at your bankOn the bank’s own site or app. Your password never passes through Navefi.
The bank issues the authorisationUnder PSD2, and only for reading accounts and transactions.
Navefi reads, and only readsInitiating payments or transfers is not part of what the bank granted. We could not move your money even if we wanted to.
You cut it whenever you wantRevoke the connection in Navefi or at the bank itself. From that moment we receive nothing more from that account.

Connected banks

Read-only access, under PSD2

The real application’s connections panel.

We never see your credentials: The bank connection runs under PSD2. You authenticate on your bank’s own site or app, and the bank hands us a read authorisation only. Your password never passes through us.
Read-only access: The authorisation your bank issues allows reading accounts and transactions. It does not allow initiating payments or transfers. Even if we wanted to, we could not move your money.
Encrypted in transit and at rest: All traffic uses TLS. Sensitive data, including connection credentials, is encrypted in the database with keys held outside it.
Hosted in the European Union: The database and files sit in European Union data centres, under the GDPR.
Two-factor authentication: You can enable authenticator-app codes on your Navefi account. We recommend it.
The right to take it and to erase it: Export everything that is yours in an open format, whenever you want. Delete the account and its data in settings, without asking anyone.
The authorisation is yours and revocable: You can cut a bank connection in Navefi or at the bank itself. From that moment we receive nothing more from that account.
No data sales, no advertising: We do not share financial data with third parties for commercial purposes. Our revenue comes from subscriptions.

Found a security problem? Write to [email protected]. We answer every report and we do not pursue good-faith researchers.