Finometr
Security

What happens when you connect a bank account

Finometr reads your business transactions to build budgets and forecasts. It cannot move money, and it never receives your banking password. Here is the whole mechanism, in order.

The connection, end to end

Four parties, one direction of travel. Your credentials never reach Finometr.

You
On finometr.com, you pick your bank and press Connect. finAPI’s connection form opens.
Password + 2FA — never reaches Finometr
Your bank
You sign in on your bank’s own page — or, for banks without a redirect flow, in finAPI’s secure form. Either way your credentials never reach Finometr.
The access you authorised
finAPI
BaFin-licensed provider. Runs the connection form, connects to your bank with the access you authorised and passes read-only account data to Finometr.
Balances & transactions
Finometr
Reads the balances and transactions finAPI passes on. Nothing more.
What we receive
Account name, account holder, IBAN or account number, and balance
Transaction history: date, amount, counterparty, reference
Your email address, for the Finometr account itself
What we never receive
×Your banking password, PIN or 2FA codes
×The ability to initiate a payment or transfer
×Data from accounts you didn’t connect
×Card PINs or security codes (CVV)
Storage

Where the data lives

Your data is stored on EU infrastructure, encrypted in transit and at rest. Access inside Finometr is limited to the engineers who keep the service running.

Encryption
TLS for everything in transit; stored data is encrypted at rest, and the password of your Finometr account is kept only as a hash.
Location
Bank data is stored on EU infrastructure. A small set of named subprocessors outside the EU (for example, AI categorisation of transactions) receives data under data-processing agreements — the full list is on our subprocessors page.
No resale
We do not sell user data, and we do not share it with advertisers.
Legal framework

Who is allowed to do what

Open banking in the EU runs on PSD2. Under that directive your bank must give a licensed provider access to your account data — but only after you authorise it, and only for the scope you authorise.

finAPI GmbH is that licensed provider. It holds the BaFin licence for account information services and operates the connection to your bank. Finometr is not a bank and holds no BaFin licence; we build the analysis on top of the data you have authorised. This is also why Finometr can never initiate a payment: we never hold that permission in the first place.

Processing of personal data follows the GDPR: you can request access, correction, export or erasure at any time, and erasure is available directly in your settings.

Your control

Revoking access and deleting data

Disconnect one bank
Remove a bank connection in Finometr settings and the access token is revoked. You can also revoke it from your bank’s own app — banks are required to offer this.
Delete your account
Settings → Delete account & data. This removes your Finometr data and instructs our provider to delete the corresponding data on its side.
What finAPI keeps
Per finAPI’s technical service documentation, its pseudonymised technical logs are kept for 21 days. As a licensed account information service, finAPI must also retain certain records for up to 10 years under German financial law (ZAG/GwG) — a legal obligation, not a business choice.
Already deleted your account?
If you need written confirmation after deletion, email support@finometr.com and we’ll confirm what was removed and when.
Delete my dataRead the FAQ
AI assistants

What a connected assistant can do

You can connect an AI assistant, such as Claude or ChatGPT, to your Finometr account. It works only through Finometr's own tools and only with what you allow.

You choose what to allow
You sign in on Finometr’s own page and choose Read, Write or both. Read lets the assistant see what Finometr’s tools return. Write lets it add, edit and remove manual transactions and planned payments, restore what was removed, create manual accounts, business units and projects, import statements you give it, set the category, note and project of transactions, set budget targets, mark notifications as read and put a setup suggestion off for 30 days. On a bank transaction it can change only the category, note and project, and no tool deletes one.
Same rights as you
The assistant sees your units with the role you have in each; in a unit shared with you it sees no more than you do. It never gets your Finometr password or your bank login.
Short-lived access
The connection uses OAuth 2.1 with PKCE. An access token is valid for one hour and is renewed with a refresh token valid up to 90 days. Finometr stores a hash and the first characters of each token, never the whole token.
Revoke at any time
Settings → Connected assistants → Revoke: the assistant loses access within a minute. Every connected assistant, what it may do and when it was last used is listed there.
Where the answers go
What the tools return goes to the assistant’s provider (for Claude, Anthropic; for ChatGPT, OpenAI), which handles it as its own controller under your agreement with it. It is not our subprocessor.
What we log
One line per tool call — your user ID, the tool, the assistant, how long it took and whether it worked — never what was asked or answered. Kept 30 days.
How to connectPrivacy details
Responsible disclosure

Reporting a vulnerability

If you believe you've found a security issue, email support@finometr.com. We welcome responsible disclosure and ask that you give us a reasonable opportunity to address the issue before publishing it, and that you don't access or modify data that isn't yours.

Still unsure?
Check whether your bank is available to connect first. It takes ten seconds and needs no account.
Check my bank