Built to be trusted with the numbers that matter
Your financial history says a lot about you. Here is how we protect it, and what we will never do with it.
-
Encrypted in transit
Every page and request uses HTTPS. Sessions expire, and forms are protected against cross-site requests.
-
Strong passwords, stronger sign-in
Passwords are stored with Argon2id, never in readable form. Two-factor sign-in with an authenticator app is one click away.
-
Bank access, locked away
When live sync arrives, access tokens are encrypted with a separate key before they are stored. Your bank password never reaches us.
-
Read-only by design
RoyalWallet reads balances and transactions. It cannot move money, make payments or change anything at your bank.
-
Privacy on screen
Blur every amount with one tap, for trains, cafés and shared screens.
-
Take it with you
Export everything we keep about you as JSON, and your transactions as CSV, whenever you like.
-
Delete means delete
Deleting your account removes your data and revokes bank access at the provider. Statement previews are deleted within 24 hours.
-
No trackers, no ads
No advertising, no third-party analytics and no tracking cookies. Only the cookies needed to keep you signed in and to protect forms.
New
Defences we built ourselves
Quiet protections that work in the background. You will rarely notice them, and none of them sends your data to anyone.
-
Royal Gate, our own bot check
Instead of a CAPTCHA from an advertising company, your browser solves a tiny puzzle in the background while you type. Bots pay for every attempt; you never click on traffic lights.
-
Breached-password shield
When you choose a password, we check it against billions of leaked passwords. Only five characters of a scrambled fingerprint leave our server, never the password.
-
New-country sign-in alerts
If your account is signed in from a country it has never been used from, we email you straight away, with a link to secure it.
-
Trap doors for scanners
Fake entrances that only attack tools look for. Anyone who knocks on them gets an ordinary “not found” and a much harder time from then on.
-
Tamper seal
Every file of our code is fingerprinted at each release and checked every hour, so a change that did not come from us is spotted fast.
-
Locked-down browser features
Every page switches off the camera, microphone, location and other device features it does not need, keeps other sites from holding our windows, and makes your browser forget the site’s stored data when you sign out.
What we will never do
- Sell, rent or share your financial data for advertising or marketing
- Ask for your password, your card number or a code by email or phone
- Move money on your behalf: RoyalWallet cannot
- Give your data to anyone except the service providers listed in our Privacy Policy, or when the law requires it
Found a security problem? Thank you. Please tell us privately, as described in security.txt