Security at Vekfinance

You should be skeptical. Mint spent years harvesting transaction data to sell back to advertisers, and most of the replacements either charge fifteen dollars a month or follow the same playbook with a different brand. Vekfinance was built on the opposite premise: the product is the subscription, not the user. The security architecture is designed so that even a worst-case breach exposes as little as possible, and the things that matter most are not configurable away.

What we cannot do

These are not policies. They are architectural facts.

We cannot move your money. The connection to your bank is read-only by design. Plaid, our bank connectivity provider, only grants Vekfinance access to read balances and transactions. There is no transfer or payment scope in the token we hold, and no setting in the app or on the server can change that. If an attacker compromised our entire infrastructure tomorrow, they still could not initiate a payment from your account.

We never see your bank password. When you link an account, your credentials are entered directly into Plaid in a flow our servers never touch. Plaid exchanges them for an opaque access token and hands that token to us. Plaid is the same connectivity provider used by Copilot, Monarch, and Mercury, and supports more than 12,000 US banks and credit unions.

How your data is protected

Encryption at rest. The Vekfinance database is encrypted at rest with AES-256 (CBC mode with HMAC-SHA512 integrity). A copy of the database file lifted off disk is unreadable without the encryption key, which lives only in the running server process and a restricted environment file (mode 0600, owned by the service user). Bank access tokens and TOTP seeds receive a second layer of column-level encryption with a separate key, so an attacker who somehow obtained the database key would still need a second secret to read the highest-value fields. That is defense in depth, not redundancy.

Encryption in transit. Every connection uses TLS 1.3. The site is on the HSTS preload list, which means browsers refuse to load it over plain HTTP even on a user's first visit. There is no insecure fallback.

Account security. Passwords are hashed with bcrypt at cost factor 12 and compared in constant time. New passwords are checked against the HaveIBeenPwned breach database at signup and on every password change, so a credential already exposed in a public dump cannot be reused here. TOTP two-factor authentication is available from day one, with one-time backup codes issued at enrollment. Auth endpoints are rate limited. Sessions ride on HTTP-only, SameSite=Strict cookies that cannot be read by page JavaScript or replayed across origins. A strict Content Security Policy and X-Frame-Options DENY are sent on every response.

Data minimization. Vekfinance does not ask for and does not store your Social Security number, government ID, date of birth, or any write-access credential for your accounts. You can disconnect a bank, export your full data, or permanently delete your account at any time from Settings. Deletion is immediate and irreversible.

For details on what gets sent to AI providers and how that data is handled, see /ai-disclosure.

The AI privacy boundary

Your financial data never leaves your encrypted boundary, and the assistant reasons over de-identified aggregates only. Every byte that does leave is recorded in your audit trail, and raw transactions, merchant names, and account numbers are not among them.

This is not a slogan. The assistant runs on a de-identified summary of your finances (coarse bands, ratios, generic category labels) produced on our server, never your raw transactions, merchants, account names, or balances. There is exactly one path to the AI, and every payload it sends is recorded. Open the egress audit trail to see, in plain language, what the model was told and what it was never told. The one thing that does travel as-is is the question you type, which the audit records too, so do not paste a full account number or a raw statement into the chat.

How we build

The security model is enforced by the codebase, not by a checklist. A CI gate blocks merges that introduce unsafe HTML injection, dynamic code execution, or API endpoints missing the authenticated-user check. All SQL uses parameter-bound prepared statements. Errors are reported through Sentry with PII scrubbing rules in place. Site analytics run through Cloudflare (cookie-free, aggregate-only) and PostHog Cloud US (identified by internal user id only, no PII, no transactions, no ad pixels, no cross-site tracking). No tracker follows you across the web from a Vekfinance page.

How we make money

Vekfinance is funded by Pro subscriptions. That is the entire business model. We do not run ads, sell or share data with brokers, accept affiliate kickbacks from card or insurance issuers, take success fees on bills we help renegotiate, or carry outside investors who would eventually pressure us to do any of the above. If the subscription ever stops paying for itself, the response will be honest pricing, not a quiet pivot into surveillance.

Who built this

Vekfinance is an independent, self-funded app with no outside investors. It is built by people with a background in security operations and regulated-industry compliance, so securing customer data is the discipline behind the product, not a checklist hired out. It started after Mint shut down in 2024 and left people looking for a private place to track their money that would not sell their data.

Independent verification

We are pursuing third-party validation on a transparent timeline, and will not claim a certification we have not earned. As each milestone completes, the report or attestation letter will be linked from this page.

• SOC 2 Type I: targeted within the first six months of public launch.
• SOC 2 Type II: targeted within the first year.
• Annual third-party penetration test: beginning in the first year, with a public executive summary published here.
• Responsible disclosure program: active now. Good-faith security research is welcomed and will not be pursued legally.

Report a security vulnerability

Send vulnerability reports or any security question to [email protected]. Initial response within 24 hours. Please give us a reasonable window to fix before public disclosure; researchers who request credit will receive it.

Scope: the vekfinance.com web application, its API, and the infrastructure that runs them.

Safe harbor: we will not pursue legal action against good-faith security researchers who report vulnerabilities responsibly, do not access or modify other users' data, do not degrade or disrupt service, and do not publicly disclose findings before we have had reasonable time to remediate.

Frequently asked questions