Security and data handling

Bank connection and consent

Connections to financial institutions are made through a Consumer Data Right gateway accredited by the ACCC. Your identity is verified and your credentials collected by your own bank — the application opens the authorisation flow and receives back only the consent that was created.

The consent is yours, it is specific to the accounts you authorised, it lasts at most twelve months, and it can be ended at any time from the Accounts screen or from your own bank's dashboard. Ending it stops new data arriving immediately.

• Internet banking passwords never travel through this application and are never stored by it.
• Access is read-only: there is no payment initiation, transfer or direct debit.
• The data received is accounts, balances, institution identity and transactions.
• A connection broken by a password change or an MFA challenge is flagged for reconnection, and nothing is retried behind your back.

Where the integration key lives

The gateway credentials are registered as backend secrets and resolved straight into the environment of the function that talks to it. They never become public variables, are never written into the frontend bundle, and are not reachable from the browser. The browser receives only a consent session identifier, good for one flow and expiring on its own.

Notifications from the gateway arrive on a webhook address and are verified by an HMAC-SHA256 signature over the request body: an altered or forged message is refused before anything is read.

Who can read what

Authorization is not a decision the screen makes. Every record carries its owner and the two groups that stand for the household, and the API evaluates those rules before returning anything. A forged request from another household does not receive the wrong data: it receives no data.

Inside a household there are two roles. The administrator connects banks, changes the household structure, invites and removes people, and may delete records. The member sees everything and records daily life, but does none of that.

• Product sign-in accounts and passwords live in a managed identity service; we never store the password ourselves.
• Invitations are single-use, expire in seven days, and are stored only as a hash.
• Joining a household is a group membership, not a copy of the history sent somewhere else.

Where the data lives

Data is stored on managed AWS infrastructure in the Australian region (ap-southeast-2), encrypted at rest by the service itself and in transit over HTTPS.

Automatic synchronisation runs once a day, overnight in Sydney time, and can be triggered by you at any moment.

Where AI is used

An earlier version of the product had a counsellor that put your numbers into words; it was removed, because turning a household's figures into commentary edges toward financial advice, and this product is not licensed to give that. What runs today is narrower and does not do that: a model reads a bank statement's PDF file, which has no other way to be parsed, and — for any transaction your household's own rules do not already recognise, whether it arrived as a file you uploaded or through the accounts connected by your bank's Consumer Data Right consent — suggests a category from your own household's list. Your own rules are tried first, deterministically and the same way every time, on every transaction regardless of where it came from; the model is asked only about what they leave unmatched, and on its own it is never offered a category to invent.

The two paths differ in when you see the suggestion. For a file you upload, the model answers on the review screen you confirm before anything is filed. For a transaction that arrived through your bank's own connection, it is already on your ledger — a Consumer Data Right sync files it the moment your bank reports it — so the suggestion is written directly, and the transaction still sits in your review queue exactly as an unmatched rule already leaves it, for you to confirm or correct on your own time rather than before it is filed.

“Categorize with AI”, on the Cash Flow screen, is a third thing again: you asking, in that moment, for a deeper pass over whatever the review queue is currently holding. It is the one place the model may search the web for a merchant descriptor it cannot otherwise place, and the one place it may propose a brand-new category instead of forcing one of your existing ones to fit — never both together for one transaction, and never without your household's own categories still being tried first. Neither of those happens on any of the other paths above, and neither happens until you press that button.

A web search is a second, genuine third party — Tavily, not Amazon — reached only from that button, and only ever with a search query built from one transaction's own description, never anything else this product holds about your household. A category it proposes is written the same way any category you add by hand is: yours to rename, re-bucket or archive at any time from Settings.

This — reading a file, naming a transaction, and the button's own search — happens on Amazon Bedrock, under this product's own AWS account and never a third-party AI service for the reading and naming themselves. The request is sent to Bedrock's Sydney endpoint; depending on the model in use, Bedrock may itself answer from anywhere inside its Asia-Pacific region — Sydney, Tokyo, Seoul, Osaka, Mumbai or Singapore — never outside it. A search Tavily runs is answered from wherever Tavily itself operates, which this product does not control the way it controls where Bedrock is asked to answer from.

Everything the dashboard shows you, though, is computed by the product's own tested functions from your account's data. Score, projections, allocation and scenarios are arithmetic with tests behind it, the same code for every household — never a model's judgement.

Deleting

A household can disconnect its banks, delete records, and request full deletion of the account. Once the account is deleted, the household's data is removed and the associated bank connections are ended.

Deleting the account is done in the app — Settings, then Delete account — and takes effect immediately. For a copy of your data, or anything the screen does not cover, write to contact@kingdomfinance.app.