Where your data lives
Your data is stored in Ireland, inside the European Union, on Supabase. Error reports go to Sentry's EU region in Germany. Every company that handles any of your data, what it receives and where, is listed on the Sub-processors page.
Who can read it
Row level security is switched on for every table in the database. On every request made with your sign-in, the database itself checks which account is asking and returns only that account's rows.
Encryption
- Every connection to Centmond is encrypted with HTTPS.
- Bank identifiers are encrypted again on their own, with AES-256-GCM, using a key kept outside the database. A copy of the database alone does not reveal them.
- Backups of the database are encrypted before they are stored.
Signing in
- A new password is checked against known data breaches. Only the first five characters of a hash of it are sent for the check, never the password.
- You can turn on two-factor authentication with an authenticator app, and keep recovery codes in case you lose it.
- Settings shows the browsers you are signed in on, and one button signs you out of all of them.
- Sign-ins, failed attempts, password resets, bank connections, exports and account closures are written to a security log that can only be added to, never edited, and is kept for 12 months.
Bank connections
Connecting a bank is optional, and Centmond works fully without it. Connections are not open to new accounts yet, and this is how they work: a connection goes through Enable Banking, an EU bank-data provider in Finland. You sign in on your bank's own page, so Centmond never sees your bank password. The access it gets reads balances and transactions only: there is no way for Centmond to move money.
Payments
Centmond is free while it is in beta. When Premium goes on sale, payments are handled by Paddle, which acts as the seller. Your card details go to Paddle and never reach Centmond.
Your data, your call
- No ads, no ad tracking, and your data is never sold.
- You can export all of your data as one file from Settings, at any time.
- Closing your account removes your data from the live database within 30 days. The Privacy policy explains what is kept, for how long, and why.
Who runs Centmond
Centmond is built and run by one person, Mani, as a sole proprietor. The legal details are on the Imprint.
Report a problem
If you think you have found a security problem, write to security@centmond.com. Please do not test against other people's accounts or data. The same address is published in our security.txt.