Security
MoneyKestrel keeps records of money between people who trust each other, so it is built to expose as little as possible if a phone is lost, a database copy leaks or an account is attacked. This page describes what is in place today.
Signing in
- Passkeys. You sign in with a passkey that stays on your device and unlocks with your face, fingerprint or device PIN. We store only its public key, never your biometrics.
- A second factor before any money data. Until you add a passkey or an authenticator code, MoneyKestrel shows no financial data.
- A fresh confirmation for every commitment. Funding, accepting, signing, finalising a payment and deleting your account each need a new passkey or code confirmation. That confirmation is tied to that one action and amount, and expires in 60 seconds.
- Limits on guessing. Sign-in and code attempts are rate limited.
- Your sessions. You can see where you are signed in and sign out other devices; signing out takes effect immediately.
Your data
- Encrypted under your own key. Your most sensitive details are encrypted with AES-256-GCM under a key that belongs to you before they are stored: payment handles, bank tokens, transaction descriptions, receipts, statements and exports. Files on a loan are encrypted under that loan's key.
- Keys under a master key. Those keys are themselves encrypted under a master key that only our servers hold. A deploy checks that it is using the right master key before it touches any data.
- Each person sees only their part. Who can see what is enforced by the database itself, and tested: a borrower never sees what each funder put in, and your bank data is visible to you alone.
- A record nobody can rewrite. Loan ledgers are append-only: a correction is a new entry, never an edit. Changes to a loan are written to a hash-chained log.
- Deleting means unreadable. Deleting your account destroys your key, so everything encrypted under it can no longer be read by anyone.
- HTTPS everywhere. The app, our servers and this site are served only over encrypted connections. This site uses no cookies and loads nothing from other sites.
How we build and run it
- Every change is reviewed and tested before it ships: automated tests (including tests that one person can't read another's data), a full preview of the app with its own database, and a code review that must be clean of security findings.
- Credentials are kept in a secrets store, never in code. Test copies of MoneyKestrel use their own keys and never send real email or notifications.
- Our providers are listed in the privacy policy.
Planned
- An offline recovery key, so encrypted data could still be recovered if the master key were lost.
- Point-in-time database recovery with a tested restore drill.
- Access logs showing when funders view a borrower's shared information.
Reporting a problem
If you think you've found a security problem, write to hello@moneykestrel.com. Please don't test against other people's accounts or data. We'll reply, and we'll tell you when it's fixed.