Built to be trusted with the numbers that matter
Your financial history says a lot about you. Here is how we protect it, and what we will never do with it.
-
Encrypted in transit
Every page and request uses HTTPS. Sessions expire, and forms are protected against cross-site requests.
-
Strong passwords, stronger sign-in
Passwords are stored with Argon2id, never in readable form. Two-factor sign-in with an authenticator app is one click away.
-
Bank access, locked away
When live sync arrives, access tokens are encrypted with a separate key before they are stored. Your bank password never reaches us.
-
Read-only by design
RoyalPay reads balances and transactions. It cannot move money, make payments or change anything at your bank.
-
Privacy on screen
Blur every amount with one tap, for trains, cafés and shared screens.
-
Take it with you
Export everything we keep about you as JSON, and your transactions as CSV, whenever you like.
-
Delete means delete
Deleting your account removes your data and revokes bank access at the provider. Statement files are never kept.
-
No trackers, no ads
No advertising, no third-party analytics and no tracking cookies. Only the cookies needed to keep you signed in and to protect forms.
What we will never do
- Sell, rent or share your financial data for advertising or marketing
- Ask for your password, your card number or a code by email or phone
- Move money on your behalf: RoyalPay cannot
- Give your data to anyone except the service providers listed in our Privacy Policy, or when the law requires it
Found a security problem? Thank you. Please tell us privately, as described in security.txt