How we protect your bank connection, and what we can prove.
Kasandro reads your accounts through Enable Banking, read-only. Below: what happens when you connect a bank, who the vendors are, what the code does, how to report a hole and which tests were done. What runs is kept apart from what is planned.
The bank connection in five questions
Before you connect a bank
- Do I enter my bank password here?
- No. You log in on your bank’s own page or in its app. Kasandro never sees your login, password or card number.
- Who fetches the data?
- Enable Banking Oy, a registered account information service provider regulated by the Finnish FIN-FSA. It handles the login and the consent at your bank; Kasandro receives the account data you allow. Its own privacy policy applies to that step.
- Which data?
- Read-only, only the accounts you select: transactions (date, amount, counterparty, title, and place and time when the bank provides them), the balance and the account name. Kasandro cannot move a single cent.
- For how long?
- Until the consent your bank grants ends: PSD2 banks grant 90 or 180 days, and we go by the date the bank returns. A week before it ends we ask whether to renew in one tap.
- How do I revoke it?
- In Kasandro: disconnect the bank in one tap, or “Delete everything”. At your bank: withdraw the consent in its app or online banking (names differ between banks). After revoking, Kasandro stops reading.
Who touches your data
Below are the vendors and what they publish about themselves, as we read it on 13 October 2026. These are their statements, not our certificates.
| Vendor | What for | What it publishes | Its page |
|---|---|---|---|
| Enable Banking Oy | bank login, consent, account access (PSD2) | On its site it says it is a registered account information service provider regulated by the Finnish FIN-FSA. On the pages we checked it claims no security certification. | enablebanking.com/tpp-infrastructure |
| Netlify | hosting of the site and the app | On its security page it lists SOC 2 Type 2 and ISO 27001. | netlify.com/security/ |
| Neon | database | On its security page it lists SOC 2 Type II and ISO/IEC 27001:2022. | neon.com/security |
| Stripe | subscription payments | It says it is certified to PCI Service Provider Level 1 and produces SOC 1 and SOC 2 Type II reports annually. | docs.stripe.com/security |
| Resend | e-mail (sign-in codes, the letter) | It says it holds a SOC 2 Type II report. | resend.com/security |
| Anthropic, ElevenLabs | assistant, letter, voice | We did not check their certifications for this page, so we cite none. Processing regions and retention: the subprocessors page. | Subprocessors |
The certifications in the table are the vendors’ own statements and cover their systems; they are not certifications of Kasandro.
What the code does
Runs today and can be checked in the repository:
- Every server response carries security headers (content security policy, HSTS, no framing, nosniff, referrer policy).
- On every change the CI audits the dependencies and stops the build on a critical vulnerability (npm audit at the critical level). Blocking.
- On every change the CI scans the code for secrets such as keys and passwords (gitleaks) and stops the build if it finds one. Blocking.
- Static analysis of the code (Semgrep) on every code change: a finding of severity ERROR stops the build. Blocking.
- A scan of the whole repository history for secrets that really work (TruffleHog checks them with the issuer). Blocking.
- An OWASP ZAP baseline scan (passive, no attacks) of the built site on every code change. New findings stop the build.
- OSV-Scanner compares the dependencies with a database of known vulnerabilities when they change and every week. New findings stop the build.
- Every week Dependabot opens grouped pull requests with the dependency updates it found (dependabot.yml); a weekly routine consolidates all open ones into a single pull request and works on it until every blocking check passes; a human merges it.
- The public pages have no sign-in and touch no bank data.
Designed, not running yet:
- Transactions encrypted under a household key, no raw bank responses after normalisation, no content in logs.
- Sign-in with a one-time code by e-mail, no Kasandro password.
- Disconnecting a bank in one tap and “Delete everything”, backups included within a declared period.
- Kasandro honours the consent end date the bank returns and stops reading once it is revoked.
Report a vulnerability
Found a hole? Write to support@kasandro.com, our only address. Say where it is and how to reproduce it. Do not send bank data or sign-in codes: they are not needed. The security.txt file is here: security.txt
Security testing
First runs, 13 October 2026: Semgrep: 0 findings. OWASP ZAP baseline: 63 checks passed, 0 failed. TruffleHog, the whole repository history: 0 secrets. The dependency scan flagged known vulnerabilities, and we upgraded the packages that had a fix.
See also: Subprocessors · Privacy · Kasandro on your phone · Kasandro: what is checked on every change · OWASP ZAP
Kasandro is an insight tool for your finances, not investment or financial advice.