Security

Last updated: 17 October 2026

Small Wallet reads your bank transactions, which say a great deal about you. This page describes how that information is protected: in transit, at rest, from other users and from Small Wallet's own staff, and where those protections stop.

Bank connections

Banks are connected through Plaid. Your banking username and password are entered in Plaid's own window and never reach Small Wallet.
Access is read-only: Small Wallet requests only Plaid's Transactions product, never account or routing numbers, and cannot move money in or out of a connected bank account.
Plaid access tokens and Wise API tokens are encrypted with Fernet (AES-128-CBC with an HMAC-SHA256 signature) before being stored, using a key held outside the source code and the database.
Disconnecting an account revokes the connection at Plaid and deletes the transactions and balances it provided.

Encryption of your transactions

A transaction's description, merchant name and categories are encrypted to a key that belongs to you alone. They cannot be read by Small Wallet's staff, through the administration interface, or by anyone holding a copy of the database.

Each account has its own X25519 key pair. Every value is sealed to the public key with a fresh ephemeral key and AES-256-GCM, so the background sync can encrypt new transactions as they arrive without being able to read them back.
The private key is never stored in the clear. It is kept wrapped twice with AES-256-GCM: once under a key derived from your password with scrypt, and once under a one-time recovery code shown to you when the key is created.
While you are signed in, the unwrapped key is held in your session encrypted under a random key that lives only in a separate HttpOnly cookie in your browser. Neither the session store nor the cookie opens anything on its own.
Spending is grouped by merchant through a keyed hash (HMAC-SHA256) derived from your private key, so identical merchants still match without the merchant name being stored in a readable form.
Changing your password re-wraps the key. A password reset cannot, because the old password is gone: the recovery code then reopens it. If both are lost, the encrypted descriptions cannot be recovered by anyone, Small Wallet included.

Amounts, dates, balances, account names and your budget settings are not encrypted this way, because the scheduled jobs that compute your balances and send your emails need to read them while you are away. They are protected by the access controls below.

Accounts and access

Passwords are hashed with Argon2.
Every sign-in is finished with a six-digit code sent to your email address.
Five wrong passwords from one IP address are refused for an hour, and ten wrong sign-in codes in a row lock the account for an hour.
All traffic to the site is encrypted with HTTPS.
Every query is scoped to the signed-in user, so no account can read another's data.
Every form is protected against cross-site request forgery.

Money movement

Small Wallet can move money only between your own Wise balances, and only if you connect Wise with a token you create yourself. It does so when you ask it to, or under a tax rule you have configured.

Each transfer is claimed and recorded before any money moves, under a lock on your rules, so two requests arriving together — or a request and the nightly job — can never set aside the same paycheque twice.
Every transfer, with its amount, balances, date and what triggered it, is kept in an audit log you can review on the Transfer history page.

Service providers

Small Wallet relies on Plaid (bank connections), Wise (optional transfers), Stripe (card payments, which Small Wallet never sees), Postmark (email delivery) and Alwaysdata (hosting). Each receives only what its job needs. No transaction data is sent to any artificial-intelligence service; categorization is done by fixed rules and the merchant mappings you confirm.

Limits

Small Wallet fetches your transactions from Plaid and Wise itself, so a description is briefly in the server's memory, in the clear, while it is being encrypted. The promise is that it is unreadable at rest and to staff tools, not that it is never seen.
Because the scheduled jobs have no key, new spending that arrives while you are away is counted as uncategorized — in the journal and the daily email — until you next sign in.
Summary emails contain budget figures and category totals, never individual transactions, but email itself is not end-to-end encrypted.
No system is perfectly secure, and nothing here is a guarantee against every possible breach.

Reporting a problem

If you believe you have found a security issue, please write to privacy@smallwallet.net. Reports are read by the developer. Please do not access other people's data while investigating.