Security

How PersonaFi protects your account and your data. Only what we actually do, in plain English.

Last updated 11 October 2026

The short version

  • We never see your passwords. Sign-in is run by Google, and bank connections go through Basiq.
  • Your data is encrypted on its way to you (HTTPS) and where it's stored (Google Cloud).
  • The AI gets as little as possible. No name, no email, no bank login, and it's asked not to keep anything.
  • No trackers. No advertising or analytics tools on any page.

Signing in

  • PersonaFi's sign-in is run by Google Identity Platform. If you sign up with a password, Google holds it; PersonaFi never receives or stores it. You can also sign in with your Google account.
  • Once you're signed in, your session is kept in a cookie that's signed, so it can't be changed or forged; it's only sent over HTTPS, and it can't be read by scripts on the page.
  • PersonaFi won't start in production without its secret signing key, so sessions can't fall back to an insecure default.
  • During the beta, a new account needs an invite code.

Your data

  • Pages and data travel over encrypted connections (HTTPS).
  • Your data is stored on Google Cloud in the United States, which encrypts the data it stores.
  • If you connect a bank, the connection goes through Basiq, an accredited open-banking provider. Your bank login stays with Basiq and your bank. (Bank connections are off during the beta.)
  • If you upload a CSV, PersonaFi reads the transactions from it and keeps those and the file's name. The file itself isn't kept.

Your coach and AI

  • Your coach only gets the figures PersonaFi works out to answer your question, never your full transaction history, email address or bank login.
  • Your first name is swapped for a stand-in name before anything is sent, and put back in the reply.
  • Every request asks OpenAI not to store it.
  • Coach chats are deleted automatically after 90 days.

The Privacy page lists exactly what's sent.

Who can see it

  • Admin access is limited to named PersonaFi staff on an allow-list, who must sign in with a verified email address.
  • We don't sell your data or share it for advertising.

You're in control

  • Download my data, in Settings, gives you a spreadsheet of your transactions, monthly totals, profile answers and coach chats.
  • Delete my account, in Settings, revokes any bank connection, deletes your sign-in and deletes every record linked to your account, with a final check a couple of hours later to catch anything still arriving.

Seen something wrong?

If you think something's wrong with your account, or you've found a security problem, email support@personafi.com.au straight away.

No system is completely secure, but we'll keep this page up to date with what we do.