We never see your bank login
Unequis does not ask for, receive, or store your banking credentials. Connections are made through regulated aggregation providers — Plaid, Pluggy and Tink — who are authorised in the markets they serve. You authenticate on your bank’s own screen. What comes back to us is a token that permits reading, nothing more.
Read-only by design
Our integrations hold no payment-initiation scope. Unequis can read balances and transactions. It cannot make a transfer, open a payment, or move money in any direction — not on your instruction, and not if our own systems were compromised. This is a structural limit, not a policy we promise to follow.
Encryption
All traffic runs over TLS. Provider access tokens are encrypted with AES-256 before they are written to the database, using a key held outside it, so a copy of the database on its own does not yield working credentials.
Isolation between accounts
Every table carrying user data has row-level security enabled in Postgres, and every policy is scoped to the authenticated user id. Isolation is enforced by the database itself rather than by application code remembering to filter, which is the layer that usually fails.
What we do not do
We do not sell your data, share it with advertisers, or use it to build profiles for anyone but you. We run no third-party analytics and no advertising tags — see our cookie policy, which is short for that reason.
Your controls
You can disconnect any bank connection at once; transactions already imported stay in your history and new ones stop syncing. You can delete your account from Settings at any time. Deletion is immediate and cascading: connections, accounts, transactions, insights and subscription records are removed, and any active subscription is cancelled first.
What we do not claim
We do not hold a SOC 2 report and we are not a regulated financial institution. Plenty of products this size imply otherwise; we would rather tell you where the line is. Our providers carry the regulatory permissions that reach your bank. We carry responsibility for what happens to the data afterwards.
Reporting a vulnerability
If you believe you have found a security issue, email contact@unequis.io. Please include enough detail to reproduce it. We will acknowledge within three business days and will not pursue action against anyone reporting in good faith.