Security and privacy

Spendle works offline-first and encrypts your administration with a password that only you know. Below you see in two steps how your data travels from your device to the Spendle server, and where it is protected along the way.

Offline-first and local storage

The administration you are actively working with — the working file — is stored locally in the IndexedDB storage of your browser on the device where you are signed in. Processing, reports, filters and the search index all run in your browser, without data being sent to a server for processing.

As a result, Spendle also works without an internet connection. Retrieving new transactions via PSD2 and synchronising with your Spendle account require a connection.

Your account: email address and password

Your email address is not stored in readable form in the Spendle database; it is only used to find your account or to send you a reset code or invoice. Your password never leaves your device in readable form and Spendle does not store it anywhere. When you sign in, Spendle only checks whether the protected version matches.

Your administration: transactions, balances and attachments

Your administration is encrypted twice. You apply the first layer yourself with your administration password, before anything leaves your device; Spendle cannot open that layer. That first layer is also on your own device, so you can continue without internet. Spendle applies the second layer, so that a copy of the database or backup yields nothing without Spendle’s secret keys. Attachments are protected the same way. Server, database and backups are in an Amazon Web Services (AWS) data centre in Frankfurt, Germany: your data stays within the EU.

How to keep it safe

Choose a strong, unique administration password. That is the layer that always holds.
Use a different password for your account than for your administration.
Keep your administration password safe, for example in a password manager. Spendle cannot recover it for you.

See Synchronising for switching cloud synchronisation on and off.

In the Android or iOS app, the administration password can be unlocked with Face ID (iOS), Touch ID or fingerprint (Android). This can be activated via the menu More > Settings > Biometric unlock.

Bank connection via PSD2

PSD2 connections run via GoCardless, an account information service regulated by DNB. Spendle:

Does not store bank login credentials.
Stores a reference to your active connection (status, validity period) — no transaction or balance data on the server.
Retrieves transactions and balance via the GoCardless API, after which everything is immediately encrypted and stored in your local working file.

Your consent at your bank is valid for up to 180 days. After that, renew the connection at your bank.

Transport and platform security

The Spendle infrastructure follows current security standards:

TLS: modern cipher suites only (AES-GCM, ChaCha20); older TLS versions are disabled.
Security headers: Content Security Policy (CSP) and HSTS.
Library updates: dependencies are updated regularly.

The latest technical maintenance is described in Security patches.

As a user, you have the right to:

Access to your personal data.
Correction of incorrect data.
Deletion (right to be forgotten) — closing your Spendle account removes account data and server copies within 5 days. See Close account.
Data portability — export your transactions as a CSV file. An .sdb export contains the full administration, but can only be opened in Spendle itself. See Export administration.
Object to certain processing and withdrawal of consent (for example for PSD2 connections).

The full privacy statement is available at spendle.eu/privacy.html.