Security and privacy
Your financial life deserves care. Here's specifically what Kemback does to protect it, and what it doesn't do with it.
We never store bank passwords
Kemback never asks for your bank password. Today you import files your bank gives you. Automatic sync (coming with Plus) will connect through Plaid, so your password goes to your bank, not to us, and access is read-only.
Households kept apart, twice
Every request is scoped to your household in the application, and the database enforces it again with row-level security, so a mistake in one layer can't show your data to someone else.
Strong sign-in
Sign in with a passkey (Face ID, Touch ID or a security key), add an authenticator app as a second factor, and see and sign out every device. Passwords are stored only as Argon2id hashes.
Secrets sealed
Sign-in links, recovery codes and session tokens are stored only as one-way hashes. Anything we must read back, like an authenticator secret, is encrypted with AES-256-GCM.
Encrypted in transit
kemback.com is HTTPS only. The iPhone app goes further and only trusts kemback.com's own certificate authority.
A tamper-evident record
Every change in a household is written to an activity log where each entry is chained to the last, so the history can be checked and can't be quietly rewritten.
Private accounts
In a shared household, any account can be private to you. It never appears to anyone else, in the app or in their exports.
No selling, no ads
Kemback is paid for by its plans. We don't sell your data, rent it, or use it to show you financial product offers.
Yours to take
Export everything, as JSON or CSV, whenever you want, on every plan.
Lock-screen safe
Alert emails and notifications say only how many alerts there are in the subject or on the lock screen, never amounts or account numbers.
Where your data lives
Kemback runs on servers rented from Hetzner in Germany. Email is sent through Postmark. When bank sync arrives, it will connect through Plaid. Our Privacy Policy lists every service that handles your data and why.
Found a security problem? Please tell us at security@kemback.com.