Security & privacy, in plain English

You're trusting Praesco with the most sensitive data you have. Here is exactly how we protect it. The full legal detail lives in our Privacy Policy.

You log in through your bank, not through us

When you connect an account, you enter your bank credentials directly with Plaid, our data-connection provider. Your bank password never touches Praesco's servers. Praesco receives a read-only view of your balances, transactions, holdings, and card details. It can read your money. It can never move it.

Praesco recommends, it never executes

Nothing in the product moves money, pays a bill, or places a trade on your behalf. Every move is a recommendation you choose to act on yourself, inside your own bank.

Your data is encrypted

All data travels over encrypted connections (TLS). Your financial-institution access tokens are encrypted at rest with AES-256-GCM. Your financial records are stored on encrypted infrastructure. Your browser also keeps a working copy on your device so the app loads fast; it lives with your other browser data and is cleared when you sign out. Access to your data requires your authenticated session.

Two-factor authentication

Two-factor authentication is available on every account, and we recommend turning it on.

You control your data

• Export: download your data as CSV files from inside the app, any time.
• Delete: delete your account and its data from Settings. When you do, your data is removed from our production systems and we instruct our providers to delete it under their terms.
• Prefer not to log in? Email privacy@praesco.io and we will handle export or deletion.

What we never do

• We never sell your data.
• We never show ads.
• No bank, lender, or product provider pays us to recommend anything. Our only revenue is the subscription you pay.
• Your data is never used to train a shared or third-party AI model.

How the AI works

Praesco's assistant runs on Anthropic's API. Your financial context and chat messages are sent to Anthropic solely to generate your answers, under its Commercial Terms and Data Processing Addendum. Anthropic deletes those inputs and outputs within 30 days and does not use them to train its models.

Our security program

We maintain a written information security program consistent with the federal GLBA Safeguards Rule, the standard that governs how financial services handle nonpublic personal information. Praesco has not yet completed an independent penetration test; one is scheduled before public launch, and this page will say so when it passes.

Infrastructure

Praesco runs on Supabase and Netlify. Both maintain SOC 2 Type 2 and ISO 27001 certifications, independently audited. Like most apps our size, Praesco itself is not separately certified; we rely on these providers' audited infrastructure.

Report a vulnerability

If you believe you have found a security issue in Praesco, email security@praesco.io. We will acknowledge within two business days and keep you informed until it is resolved. Please do not access, change or share other people's data while testing, and give us reasonable time to fix before disclosing publicly. We do not run a paid bug bounty at this time. Machine-readable contact: /.well-known/security.txt.

Questions

Email privacy@praesco.io. Full detail is in our Privacy Policy.