The security of your data and personal information is of utmost importance to us. In this overview, we outline the ways you can help maintain the security of your own account, the steps we take to protect it, and where your data is actually hosted and processed. Do you have a security issue you'd like to report to us? Email us at info[at]envido.eu.
Envido's application, database, and file storage run on servers located in Germany, within the European Union, operated by Hetzner Online GmbH. We don't route your data through infrastructure outside the EU/EEA except where a specific service provider listed in our Privacy Policy requires it (for example, payment processing or optional AI features) — in those cases, we rely on Standard Contractual Clauses or another recognized safeguard.
Your connection to Envido is always encrypted using TLS/SSL. That means nobody can intercept your communication with us — this is especially important if you're using Envido on a public WiFi network. We monitor our TLS configuration on an ongoing basis to keep it aligned with current best practice.
Envido is not a transactional service like a bank — it is a READ-ONLY service that gives you great ways to view and manage your financial picture. When you connect a bank account, access is provided through our regulated open-banking partner, GoCardless, on a strictly read-only basis: no one — not even you — can move, withdraw, or transfer money out of your accounts through Envido. We never see, receive, or store your online banking login credentials; those are entered directly with your bank or through GoCardless's own secure authorization flow.
It's entirely up to you how long you want to use Envido. You can delete your account at any time, and all your associated information — personal data, bank connections, transactions, budgets, and categories — will be permanently deleted, except for the limited billing records we're legally required to retain (see our Privacy Policy for details).
Your Envido password is hashed with the bcrypt algorithm and stored only as that hash — it cannot be reversed into your actual password. Sensitive fields, such as your bank account numbers (IBANs) and secondary email address, are never stored as plain text; they are encrypted at the database level using AES-256 encryption, the same standard widely used by financial institutions.
We work with a small number of specialized providers to run the Service, each bound by their own security and data-protection commitments: GoCardless for open banking, Stripe for subscription payments, Postmark for transactional email, MailerLite for opt-in newsletters, Cloudflare for spam/bot protection, and OpenRouter (routing to providers such as Anthropic or OpenAI) for optional AI features. Full details are in our Privacy Policy.
In your Envido settings (Settings → Security) you can view your last login data for your account. If you spot any suspicious activity, ensure your devices are secure and change your password immediately.
YOU ARE RESPONSIBLE FOR MAINTAINING THE CONFIDENTIALITY AND SECURITY OF YOUR EMAIL ADDRESS AND PASSWORD. WE ALSO RECOMMEND THAT YOU CHANGE YOUR PASSWORD PERIODICALLY. YOU MAY NOT PROVIDE THESE CREDENTIALS TO ANY THIRD PARTY. IF YOU BELIEVE THEY HAVE BEEN STOLEN OR MADE KNOWN TO OTHERS, YOU MUST CONTACT US IMMEDIATELY AT INFO[AT]ENVIDO.EU AND CHANGE YOUR PASSWORD IMMEDIATELY. WE ARE NOT RESPONSIBLE IF SOMEONE ELSE ACCESSES YOUR ACCOUNT THROUGH REGISTRATION INFORMATION THEY OBTAINED FROM YOU, OR THROUGH A VIOLATION BY YOU OF THIS PRIVACY POLICY OR THE ENVIDO TERMS OF USE.