Security and your data

Lirandel handles sensitive financial information, so it collects only what it needs and protects it at every step.

Signing in

Two-step sign-in is required for everyone, with recovery codes if you lose your phone.
Passwords are stored only as a salted hash. Sessions expire after inactivity, and you can sign out other devices.
Repeated wrong passwords are slowed down to stop guessing.

You connect banks through Plaid. You sign in to your bank on Plaid's screen, so Lirandel never sees your bank username or password.
Lirandel gets read-only access. It can't move money.
The access token Plaid gives Lirandel is encrypted (AES-256) with a key kept separately from the database. Disconnecting a bank ends Lirandel's access at Plaid and deletes that bank's data from Lirandel.

Download everything Lirandel holds about you, or delete your financial data or your whole account, from Settings.
Transactions older than 24 months are deleted automatically.
If you don't sign in for 24 months, Lirandel deletes your financial data and ends its access to your banks, after emailing you 30 days before.
Lirandel doesn't sell your data. Nothing is shared with a partner unless you sign a separate, dated opt-in, which you can withdraw at any time.

If you think you've found a security issue, please tell us through the address on the About page. See also the Privacy Policy.