Security

Last updated November 2026. Yegly sees your money so you can plan with it, so keeping it safe comes first. Here is how we do it.

The short version

• Bank connections are read-only. Yegly can see balances and transactions; it can never move money.
• You connect banks through Plaid. Yegly never sees or stores your bank username or password.
• Everything is encrypted, in transit and at rest.
• Every account uses two-step sign-in with a passkey.
• Your data lives in its own private workspace. Only you and the people you invite can see it.
• You can delete your account, and everything in it, at any time.

Your bank connections

Plaid connects Yegly to thousands of banks and credit unions. Many banks have you sign in on their own site, so your password goes only to your bank. Yegly receives balances and transactions only, and keeps the access Plaid gives it encrypted a second time with AES-256. Disconnect a bank in Yegly and its access is revoked at Plaid at once, along with its transactions.

Encryption

• In transit: every connection to yegly.com and the Yegly app uses HTTPS (TLS 1.2 or newer).
• At rest: our database and files are encrypted by our hosting provider, Cloudflare. Bank and tool connections are encrypted again by Yegly before they are stored.
• Payments: handled by Stripe. We never see or store your full card number.

Signing in and who can see what

• You sign in with Google or a one-time code we email you, then confirm with a passkey (Face ID, Touch ID, Windows Hello or your phone's screen lock). Two-step sign-in is required for every account, and passkeys can't be phished or reused like passwords.
• Sign-in sessions are stored as one-way hashes and expire after 7 days.
• Each customer's data is kept in its own workspace, and every request is limited to the signed-in person's workspace.
• Inside a workspace, roles (admin, bookkeeper, manager, staff) decide what each person can see and change, business by business. Your accountant gets a view-only seat.

How we run Yegly

• Everyone on our team uses two-step sign-in on every system that touches customer data, and access is limited to what each person needs and reviewed every quarter.
• Our code is scanned for known vulnerabilities continuously, and we patch critical issues within 7 days.
• Yegly runs on Cloudflare's platform, so servers are patched and monitored by Cloudflare.
• We follow a written information security policy, reviewed at least once a year.

Your data, your choice

Delete your account from the app any time (profile menu → Delete account). Your banks are disconnected at Plaid, your plan is cancelled, and your data is deleted, then leaves our backups within 30 days. See our privacy policy for the details.

If something goes wrong

If a security incident affects your data, we will tell you promptly, and within 72 hours of confirming it.

Report a security issue

Found a vulnerability or something that looks wrong? Email [email protected] with the subject "Security". We read every report, reply quickly, and won't take action against anyone who reports in good faith.