Skip to content

Security

Last updated: 2026-10-10

Your finances are sensitive. Here is what we do, without promises we cannot keep.

What we do not hold

We never ask for or store your bank credentials: Xpenses does not connect to your bank. We do not see or store your card either: payments are processed by Stripe, which is PCI DSS compliant.

How we protect your account

  • Passwords are stored only as bcrypt hashes; nobody, including us, can read them.
  • All traffic is encrypted (HTTPS).
  • Each wallet is visible only to its members, and automated tests check this on every code change.
  • Wallet invitations use single-use links that expire after 7 days and only the invited person can accept.

Who accesses your data

Nobody on the team looks at your data day to day. We would only access it if you ask us to solve a problem or the law requires it.

Deleting your data

You can delete your account at any time from Settings; data is deleted as described in the privacy policy.

Found a problem?

Write to [email protected]. We answer every security report.