Skip to main content
OwdynOwdyn

Legal

Security at Owdyn

How we protect your financial data.

Last updated: 28 June 2026

On this page

  1. 1. How your data is protected
  2. 2. How you sign in
  3. 3. AI features and your data
  4. 4. Payments, data location, and clarifications
  5. 5. If something goes wrong
  6. 6. Staying secure together
  7. 7. Reporting a security issue
  8. 8. Technical detail
  9. 9. Contact

How your data is protected

Your data is encrypted in three places: on the way to us, while it is stored, and again for the most sensitive fields.

On the way to us.Every connection between your browser and Owdyn uses HTTPS with modern TLS encryption, so your data is protected as it travels across the internet.
While it is stored.Your data sits in a PostgreSQL database that encrypts everything on disk.
The most sensitive fields.For values like your two-factor authentication secret and the tokens used to connect to your bank, we add a further layer of encryption inside Owdyn before anything is written to the database. Even at the database level, those values cannot be read without Owdyn's key.

The exact methods are in the Technical detail section.

How you sign in

Sign in with email and password or with Google, and turn on two-factor authentication for an extra layer.

Email and password.Your password is stored as a secure hash, never as plain text.
Google.You can sign in with your Google account. We never see your Google password.
Two-factor authentication.Optional, and you can switch it on in Settings.

Sessions expire after a maximum of 24 hours and end when you close your browser. You can log out manually at any time. Trusted devices let you reduce repeat 2FA prompts on devices you use regularly, for up to 30 days.

Rate limiting detail is in the Technical detail section.

AI features and your data

AI features are optional. When you use them, we send only sanitised data to Anthropic — never your identity or payment details.

What we send

  • Transaction descriptions, sanitised first — emails, phone numbers, card numbers, account numbers, and IRD numbers are removed before anything leaves Owdyn
  • Transaction amounts, and whether each is income or an expense
  • Your category names, as options for the AI to choose from
  • Aggregated spending summaries, only when you ask for an insight

What we never send

  • ✕Your email address or password
  • ✕Payment information such as card or bank details
  • ✕Identity documents
  • ✕Transaction dates
  • ✕Anyone else's data

Under Anthropic's Data Processing Addendum, your data is used only to generate responses for you, is not used to train AI models, and is not retained long-term. Full detail on how AI features handle your data is in our Privacy Policy.

Payments, data location, and clarifications

Payments.Handled by Stripe, a PCI-DSS Level 1 certified payment processor. We never see your full card number and store only a Stripe customer reference. You can update your payment method through Stripe's secure portal at any time.
Where your data lives.Owdyn is hosted on Vercel, with the database on Neon (PostgreSQL) in the AWS Sydney region in Australia. You can only ever see your own data.
Owdyn is not a bank.We help you track your money. We do not hold, move, or manage it, and your funds stay in your own bank accounts. Owdyn is not regulated by the Reserve Bank of New Zealand.

If something goes wrong

If a security incident affects your data, we will notify you as soon as reasonably practicable and report to the NZ Privacy Commissioner where required by Part 6 of the Privacy Act 2020. Full detail on our notification process is in our Privacy Policy. To report a concern, email support@owdyn.nz.

Staying secure together

Security works best as a partnership. A few small habits go a long way.

Worth doing

  • Use a strong, unique password.
  • Turn on two-factor authentication in Settings.
  • Keep your email account secure — it can be used to reset your password.
  • Log out on shared or public devices.
  • Review your transactions from time to time.

Best avoided

  • ✕Reusing passwords from other sites.
  • ✕Sharing your password with anyone.
  • ✕Following links in messages claiming to be from Owdyn without checking they are genuine.

No system can promise absolute security, which is why these habits matter alongside the protections we build in.

Reporting a security issue

Found something? Tell us privately and we will work with you.

If you think your account has been compromised, or you have found a vulnerability, email support@owdyn.nz. We treat security reports as a priority.

If you are reporting a vulnerability, we ask that you:

  • Report it to us privately before any public disclosure.
  • Include what the issue is, how to reproduce it, and its potential impact.
  • Give us reasonable time — at least 30 days — to investigate and fix it.
  • Avoid accessing, changing, or deleting data beyond what is needed to show the issue.

We will not take legal action against researchers who act in good faith and follow these guidelines. We will acknowledge your report within 24 hours, keep you updated, and credit you if you would like.

Technical detail

For anyone who wants the specifics, here is the detail behind the summaries above.

Encryption

  • In transit: HTTPS with TLS 1.2 or higher on all connections.
  • At rest: AES-256 disk-level encryption, provided by our database host, Neon.
  • Application layer: AES-256-GCM authenticated encryption applied inside Owdyn for the most sensitive fields — specifically your 2FA (TOTP) secret and bank OAuth access tokens used to connect via Akahu on Plus and Wise. Each value uses a fresh random initialisation vector and includes a GCM authentication tag, so tampering is detected automatically.
  • Passwords: hashed with bcrypt (cost factor 12). Plain passwords are never stored.

Access and infrastructure

  • Data isolation is enforced at the application level. Every query is scoped to your account.
  • Database access uses Prisma ORM with parameterised queries, which protects against SQL injection.
  • Database credentials and API keys are held as environment variables, encrypted by the hosting platform, never in code.
  • Authentication endpoints are rate-limited using Upstash Redis, applied globally across devices and IP addresses, with a cooldown after excessive failed attempts.
  • Hosting on Vercel, database on Neon (PostgreSQL), in the AWS Sydney region (ap-southeast-2).

Data sent to Anthropic, in full

  • Sanitised transaction descriptions; amounts and income or expense type; available category names; aggregated spending summaries on request.
  • Requests use TLS 1.2 or higher. See the AI features section above for Anthropic's full data handling commitments.

Third-party providers and certifications

  • Anthropic (AI): SOC 2 Type 2, AES-256 at rest, TLS 1.2+ in transit, multi-factor authentication for staff access, annual external penetration testing, 24/7 monitoring, role-based access control.
  • Stripe (payments): PCI-DSS Level 1, Strong Customer Authentication compliant.
  • Vercel and Neon (hosting and database): AWS infrastructure, encryption in transit and at rest, Sydney region, DDoS protection, automated backups.

We select certified providers, and we suggest reviewing their current practices if you have specific compliance needs.

Contact

Questions about how we protect your data? Get in touch.

Email: support@owdyn.nz

Legal entity: OWDYN LIMITED (trading as Owdyn)

NZBN: 9429053482907

Address: Auckland, New Zealand