Security

How Deco protects your data

Deco handles bank statements and net worth, so the bar for what "secure" means is higher than most apps. This page states plainly what protects your data at each layer, and what to do if you find a problem with it.

In transit

Every connection between the app and Deco's servers uses TLS/HTTPS. Nothing is sent in the clear.

At rest

Your data is stored on Supabase-hosted PostgreSQL infrastructure in the EU/EEA, encrypted at rest with AES-256. Row-level security policies mean a database query can only ever return rows that belong to the account making it, enforced by the database itself rather than application code.

On your device — Maximum Privacy

Turn on Maximum Privacy and Deco generates an encryption key that is stored only on your device, in the platform keychain (iOS Keychain / Android Keystore), and is never sent to us. With this on, your goals, debts, budget preferences, and manually-entered account and transaction details are encrypted (XSalsa20-Poly1305, via the audited tweetnacl library) before they ever leave your device. We cannot read them, with or without a request to. This does not apply retroactively to data already stored before the setting is turned on, and it does not apply to transactions imported from a bank statement file, which are categorized and stored the same way as Standard privacy.

What Deco does not do

Reporting a vulnerability

If you believe you have found a security issue, email usedecoapp@outlook.com with what you found and how to reproduce it. Please give us a reasonable window to fix an issue before disclosing it publicly. This is a one-person team, so response times vary, but every report gets read.

For the full legal detail behind this page, see the Privacy Policy, §6 (Data Security).