The finance copilot for your business
Security
Banker stores your business transactions and, if you connect your bank, your credentials. This page explains exactly how they are protected, what you control and what to do if you find a vulnerability.
Bank credentials
Your online-banking credentials are encrypted with a dedicated AWS KMS key, with automatic rotation, before they are stored in an encrypted PostgreSQL database. They are never stored or logged in plain text.
They are decrypted only inside the isolated task that syncs your transactions, at sync time. You can disconnect the account whenever you want and the credentials are deleted.
Your account
Sign-in uses AWS Cognito. You can turn on two-step verification with an authenticator app (TOTP) from Settings. Access sessions last one hour and renew for up to 30 days from the original sign-in.
Every workspace has roles: owner, admin, accountant and viewer. An unknown role is treated as viewer, never as admin.
Your data
Each workspace keeps its transactions and settings in its own isolated table, with point-in-time recovery (continuous backup). Deleting a workspace deletes its table and its backups together.
You can export your information from the app and request its deletion by writing to support@bankercr.com, under Law 8968.
In transit
All traffic goes over HTTPS with HSTS. The API only accepts requests with a valid session token and its CORS is restricted to bankercr.com. Emails are sent from a DKIM-verified domain.
What Banker does not do
Banker does not hold money or store card numbers. It is not a bank and not supervised by SUGEF; it is financial management software. It is not affiliated with or endorsed by BAC Credomatic.
Reporting a vulnerability
Write to support@bankercr.com with the steps to reproduce it. The /.well-known/security.txt file carries the same contact. We answer every report and take no legal action against good-faith research that does not access the data of other people or disrupt the service.
Last reviewed: September 8, 2026.
Frequently asked questions
Can Banker move money out of my account?
No. Banker reads your transactions to sort and analyze them. It does not hold money or store card numbers.
Who can see my bank credentials?
Nobody sees them in plain text: they are encrypted with a dedicated AWS KMS key before storage and decrypted only inside the isolated task that syncs your transactions.
Can I turn on two-step verification?
Yes. In Settings you can enable verification with an authenticator app (TOTP) for your account.
What happens to my data if I close my account?
Deleting a workspace deletes its data table and its backups together. You can export your information from the app first.