Security and privacy of your data

All communication between your device and Penso travels encrypted over HTTPS/TLS. There are no unencrypted paths: not on the web, not in the mobile app, not in the connections with our providers.

• Hashed passwords, never plaintext. Your password is stored using a cryptographic hash; no one at Penso can see it. We require a minimum of 12 characters.
• Two-step verification (2FA). You can enable a second factor with an authenticator app (6-digit TOTP codes), with backup codes in case you lose your phone. If you have 2FA enabled, we also block linking an external sign-in (Google or Apple) to your account, so that path cannot be used to bypass the second factor.
• Brute-force limits. Authentication endpoints are rate-limited per IP address.
• Sessions scoped to the app domain. Session cookies live only on app.penso.money. The public site (penso.money) uses no session cookies.

It is the question we get asked the most, and the short answer is: Penso is designed not to know your bank passwords.

• PDF statements: the main path for Chilean banks requires no credentials at all — you download the statement from your bank's site and upload it to Penso.
• Direct sync from the mobile app: your credentials stay on your device and are not stored on our servers. Penso only receives the captured transactions, authenticated with a token unique to your device.
• U.S. accounts (via Plaid): if you connect a U.S. account, you authenticate directly with your bank inside the Plaid flow; Penso does not receive or store those credentials. The access tokens Plaid provides us are stored encrypted with AES-256-GCM.
• Nothing in plaintext: the sensitive secrets we store — such as bank access tokens — are encrypted with AES-256-GCM (authenticated encryption, which detects any tampering with the data), and mobile device tokens are stored as hashes, never in the clear.

All your data is tied to your user, and every database query filters by it: one user cannot see another user's data. If you share your space, access is governed by roles (owner, admin, editor, view-only): someone with a view-only role cannot modify anything, and the owner can revoke any member's access at any time.

Penso offers a connector for AI assistants (such as Claude or ChatGPT) that works with OAuth 2.1: nothing connects without your explicit authorization on a consent screen. A connected assistant can only access your own space (never other people's shared spaces), irreversible operations require explicit confirmation, and you can view and revoke each connector at any time from Settings → Connectors.

Penso is not a financial institution and is not supervised by Chile's Financial Market Commission (CMF), because it is not a financial product: it is software to organize your personal finances. Penso does not hold your money, cannot move it, does not execute payments or transfers, and does not grant or broker credit or investments. The official source of your balances and transactions is always your bank.

• Export: you can export your transactions to CSV from the app whenever you want.
• Delete: you can delete your account from within the app. For security we ask you to re-authenticate, and deletion removes all your data in cascade: transactions, accounts, bank connections, budgets, goals, subscriptions, and more.
• No selling of data: we do not sell your personal data, do not use it for third-party advertising, and do not use tracking cookies.

If you believe you have found a security issue in Penso, write to us at [email protected]. We review it with priority and get back to you.