Security and privacy

The Spendle application works offline-first and encrypts your administration with a password that only you know. Below you see how your data travels from your device to the Spendle server, and where it is protected along the way.

Offline-first and local storage

The administration you are actively working with — the working file — is stored locally in the IndexedDB storage of your browser on the device where you are signed in. Processing, reports, filters and the search index all run in your browser, without data being sent to a server for processing.

As a result, Spendle is fast and also works without an internet connection. Retrieving new transactions via PSD2 and synchronising with your Spendle account require a connection.

When you synchronise with your Spendle account, an encrypted copy of your administration is stored on the Spendle server. This gives you a backup, and lets you work with the same administration on several devices, for example your phone and your laptop. Below you can read how your account and your administration are protected along the way.

Your account: email address and password

For synchronisation and backup, your Spendle licence and setting up a PSD2 connection, you need a Spendle account. You create it with an email address and a password. Below you see how these are protected.

Your email address is not stored in readable form in the Spendle database; it is only used to find your account or to send you a reset code or invoice. Your password never leaves your device in readable form and the Spendle server does not store it anywhere. When you sign in, the server only checks whether the protected version matches.

Your administration: transactions, balances and attachments

Your administration is encrypted twice. You apply the first layer yourself with your administration password, before anything leaves your device; the Spendle server cannot open that layer. That first layer is also on your own device, so you can continue without internet. Spendle applies the second layer, so that a copy of the database or backup yields nothing without Spendle’s secret keys. Attachments are protected the same way.

How to keep it safe

Choose a strong, unique administration password. That is the layer that always holds.
Use a different password for your account than for your administration.
Keep your administration password safe, for example in a password manager. Spendle cannot recover it for you.

See Synchronising for switching cloud synchronisation on and off.

In the Android or iOS app, the administration password can be unlocked with Face ID (iOS), Touch ID or fingerprint (Android). This can be activated via the menu More > Settings > Biometric unlock.

Bank connection via PSD2

PSD2 connections run via GoCardless, an account information service regulated by DNB. Spendle:

Does not store bank login credentials.
Stores a reference to your active connection (status, validity period) — no transaction or balance data on the server.
Retrieves transactions and balance via the GoCardless API, after which everything is immediately encrypted and stored in your local working file.

Your consent at your bank is valid for up to 180 days. After that, renew the connection at your bank.

Which personal data GoCardless processes for a bank connection is described in GoCardless’ privacy information for account holders. How Spendle handles your data is described in the Spendle privacy statement.

Storage on the Spendle server

The Spendle server, the database and the backups are in an Amazon Web Services (AWS) data centre in Frankfurt, Germany. Your data therefore stays within the EU.

Transport and platform security

The Spendle infrastructure follows current security standards:

TLS: modern cipher suites only (AES-GCM, ChaCha20); older TLS versions are disabled.
Security headers: Content Security Policy (CSP) and HSTS.
Library updates: dependencies are updated regularly.

The latest technical maintenance is described in Security patches.

As a user, you have the right to:

Access to your personal data.
Correction of incorrect data.
Deletion (right to be forgotten) — closing your Spendle account removes account data and server copies within 5 days. See Close account.
Data portability — export all your data as a ZIP file with CSV files, and download your attachments separately. See Export data.
Object to certain processing and withdrawal of consent (for example for PSD2 connections).

The full privacy statement is available at spendle.eu/privacy.html.