Security at ARCA
- Read-only. ARCA can see your balances and transactions. It can never move money, make payments or change anything in your bank account.
- We never see your bank login. You sign in on your own bank's app or website, not in ARCA.
- Regulated connection. Your bank connection is provided by TrueLayer, which is authorised and regulated by the Financial Conduct Authority.
- You're in control. Disconnect a bank or delete your account at any time.
How connecting your bank works
- In ARCA, you choose your bank.
- You're sent to TrueLayer, our regulated Open Banking provider, to review and agree to what's being shared.
- You're then sent to your own bank to sign in and approve access, using your bank's normal security (Face ID, a passcode or a card reader).
- Your bank gives ARCA a secure, read-only key. We never receive your bank username, password or PIN.
ARCA will never ask you to type your online banking password into the app, by email or over the phone. If anyone claiming to be ARCA asks for it, don't share it and let us know.
What ARCA can and can't do
| ARCA can | ARCA can't |
|---|---|
| See your account names, types and balances | Send, move or receive money |
| See your transaction history (amounts, dates, merchant names) | Make, approve, change or cancel payments |
| Refresh this data while your account stays connected | Change standing orders or direct debits |
| Change your bank details or settings |
This is enforced by the type of access we request from TrueLayer. We only ask for read-only data permissions, and payment permissions are never requested. Your bank also asks you to reconfirm access at least every 90 days. If you don't, the connection stops.
How we protect your data
In transit
- Everything between the app, our servers, our database and our partners is sent over encrypted HTTPS connections.
At rest
- The keys that let us read your bank data are encrypted with AES-256-GCM before they're stored, so they're unreadable on their own even if the database were exposed.
- Our database is hosted by Neon in London and is encrypted at rest.
- Your ARCA password is never stored. We keep only a one-way bcrypt hash.
Your sign-in
- Sign-in sessions expire automatically, and the long-lived tokens that keep you signed in are stored only in hashed form.
- Password-reset links expire after 15 minutes and work only once.
- After several failed sign-in attempts, the account is temporarily locked to stop password guessing.
- When an account is deleted, any existing sessions for it stop working immediately.
Behind the scenes
- Each account can only ever access its own data.
- Secrets such as encryption keys and API keys are kept out of our source code and stored as protected environment variables.
- Access to our production systems is limited to the ARCA team members who maintain the service, and only when needed to run or support it.
Spending categories and AI
ARCA sorts your transactions into categories such as Food & Dining or Transportation. We first match the merchant name against a list of well-known brands, then use an open-source AI model for anything else.
- The model runs on our own servers. Your transactions are not sent to any third-party AI company.
- Only the transaction description (such as the merchant name) is used. Your name, account details and amounts are not.
- Your data is never used to train any model.
| Partner | Role | Location |
|---|---|---|
| TrueLayer | Regulated Open Banking connection to your bank | UK / EU |
| Neon | Encrypted database hosting | London, UK |
| Railway | Server hosting | Netherlands |
We don't sell your data or share it with advertisers. See our Privacy Policy for full details.
You're in control
- Disconnect a bank at any time on the Accounts page in the app. We immediately stop retrieving new data from it. You can also revoke access directly with your bank.
- Delete your account in Settings → Edit Profile → Delete account. Your data is removed from our live database straight away, and we also ask TrueLayer to delete the data it holds for your connections. More about deletion.
Regulation
ARCA uses TrueLayer to connect to your bank. Account information services are provided by TrueLayer Limited, which is authorised and regulated by the UK Financial Conduct Authority under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 (Firm Reference Number: 901096). You can check this on the FCA Register.
Nothing in ARCA is financial, tax, investment or legal advice.
Found a security issue?
If you think you've found a vulnerability in ARCA, please email smartfinanceapp12@gmail.com with the subject "Security report". Please give us a reasonable chance to fix it before sharing it publicly, and don't access or change other people's data while testing. We'll reply as quickly as we can and credit you if you'd like.