Security

Read-only, always

When you connect a bank, Storied asks only for permission to read: balances, transactions, and the rates and payments on loans and cards. It never asks for permission to make payments or transfers, and no part of Storied can move money, even if someone got into your Storied account.

You sign in to your bank in Plaid’s window, or on your bank’s own page. Storied never sees or keeps your bank password. On an iPhone, Apple Wallet accounts are read on your phone, only the ones you choose.

Your bank connection is locked

Plaid gives Storied a key to read your accounts. We lock that key with AES-256-GCM encryption before it is saved, and the key that unlocks it is kept apart from the database. You can disconnect a bank at any time from any of its accounts, which ends Storied’s access through Plaid. You choose to keep its history or delete it.

Signing in

Sign-in is run by Clerk, which slows down and blocks anyone trying to guess their way in. In Settings, under Security, you can:

• sign in with a passkey, using your face, fingerprint or device code;
• turn on two-step sign-in with an authenticator app;
• see every device signed in to your account, and sign any of them out.

And on its own:

• the website signs you out after 30 minutes without activity, and every sign-in ends after 30 days;
• downloading your data or closing your account asks you to confirm it is you;
• the phone app locks with Face ID or your passcode after a minute away, and hides your money in the app switcher;
• we email you when a new device signs in or how you sign in changes.

How your data is kept

Everything travels over encrypted connections (HTTPS), and the database is encrypted on disk. Each household’s data is kept apart, and every request checks that what it reads belongs to the person asking. Important changes, like connecting a bank, exporting your data or changing how you sign in, are written to a log, which helps us look into anything unusual. Actions like downloading your data or bringing in a file are limited, to stop scripts, and no other site can show Storied inside a frame.

When something breaks, the error report we receive leaves out amounts, account numbers, email addresses, what you searched for and what you typed. We do not record your screen.

Your data is yours

We do not sell your data and we do not show ads. In Settings, under Data and privacy, you can download your accounts, transactions, bills, goals and settings in one file, or close your account. Closing ends bank access right away, signs out every device, and erases your data after 30 days. The Privacy Policy has the details.

Found a problem?

If you think you have found a security issue, please email privacy@storiedmoney.com with what you found and how to see it. We will reply, keep you posted while we fix it, and we will not take action against anyone who reports in good faith and does not access other people’s data.