Security at Lekkafy
Last updated: 1 June 2026
Your financial data is sensitive. We've built Lekkafy from the ground up with security as a first-class concern, not an afterthought. Here's exactly what we do to keep you safe.
No Bank Access
We never connect to your bank account. No credentials, no open banking, no third-party account aggregators. You enter what you choose.
No Passwords to Steal
Sign in with a magic link (web) or one-time code (mobile) — we never create, store, or transmit a password. This closes off password-reuse and credential-stuffing attacks, though email compromise and phishing still need their own precautions.
Encrypted at Rest
All data is encrypted at rest using industry-standard encryption. Your account data is hosted on Supabase infrastructure in the EU (Ireland region).
Encrypted in Transit
All communication between your device and our servers is encrypted. Connections over plain HTTP are rejected.
Permission-Based Access Control
Our database enforces access policies based on your user and household permissions — you can only query data you or your household are permitted to see. This restricts unauthorised queries; it is one control among several, not a guarantee against every possible compromise.
EU-Hosted Data, Global AI Processing
Your account and financial data is stored on infrastructure in the EU (Ireland). AI-assisted features send the relevant data to Google's Gemini API, which may process it outside the EU/UK under appropriate safeguards — see our Privacy Policy for details.
Authentication & Session Security
- Magic links are single-use, expire after 1 hour, and can only be used once.
- One-time codes (OTP) sent in the same email expire after 5 minutes for tighter security.
- Sessions are stored as signed, tamper-evident JWT tokens with short expiry windows.
- All authentication events (sign-in, sign-out, link requests) are logged with IP address and timestamp for 90 days.
- You can sign out of your current device at any time. Remotely revoking a session on another device you're signed into is not yet available (coming soon) — if you suspect unauthorised access, contact us immediately and we can invalidate your active sessions.
AI Processing (Receipt Scanning, Statement Parsing & Ask Lekka)
- Receipt images and statement files you upload are sent to Google's Gemini API over an encrypted connection to extract transaction data (date, merchant, amount, category) only.
- The raw image or file itself is not written to our storage or database — it exists only in memory for the duration of the request, then discarded. Only the extracted transaction data is saved to your account.
- Ask Lekka sends your question, along with the specific financial data needed to answer it (such as your budgets, recent transactions, or savings figures), to the same Gemini API. We do not save a transcript of your Ask Lekka conversations.
- This processing may occur on Google infrastructure outside the EU/UK — see our Privacy Policy for the safeguards that apply.
Third-Party Subprocessors
We use a minimal set of trusted subprocessors, all operating under data processing agreements:
| Provider | Purpose | Data Region |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Ireland) |
| Google (Gemini API) | Receipt scanning, statement parsing, Ask Lekka, budget suggestions | EU + US |
| Resend | Transactional email (magic links, invitations), via Supabase Auth | EU |
Infrastructure Security
- Production access is restricted to authorised personnel via MFA-protected accounts.
- All environment variables and secrets are stored in a dedicated secrets manager, never in source code.
- Dependencies are monitored for known vulnerabilities and updated regularly.
- Automatic backups are performed daily with point-in-time recovery.
Responsible Disclosure
We take vulnerability reports seriously. If you discover a security issue in Lekkafy, please disclose it responsibly:
Security contact: support@lekkafy.com
Please include: description of the issue, steps to reproduce, potential impact, and your contact details. We aim to respond within 72 hours and will keep you updated on our remediation progress.
We ask that you do not publicly disclose the issue until we have had reasonable time to address it.
Your Security Controls
You have direct control over your security posture:
- Delete your account and all associated data at any time from Settings → Security.
- Review and revoke active sessions (coming soon).
- Export all your data on request. Email support@lekkafy.com.