The bank and exchanges connect read-only, access keys are encrypted and the data is stored in the EU. Below is how it all works, with links to the documents.
01What's in your hands
We don't sell your data, use it for advertising or train AI on it.
You decide
Which accounts to connect, and when to disconnect them
What gets saved: Suricate only proposes, you confirm
Whether notifications show amounts
When to delete your account along with your records
The app can't
Transfer, sell or withdraw money in your name
Learn your bank password or PIN
Get your full card number or CVV
Get your wallets' private keys or seed phrases
02How each connection works
Every connection is read-only, and you are the one who starts it. Here is how it works for the bank, exchanges and wallets.
Monobankthrough the official API for services
1Degroshi is a registered Monobank provider. We create an access request, and you never type a token.
2You open the link, or scan a QR code on a computer, and confirm the request in the Monobank app. The bank shows who the request is from.
3The bank grants read-only access: the list of accounts, balances and statements. You choose which accounts to connect.
Read-only
Access can be revoked in the bank's app
No transfers in your name
Exchangesa read-only API key
1You create a key with read permission only at the exchange and paste it into the app.
2Before saving it, the app asks the exchange what the key is allowed to do. The key is only ever stored encrypted.
3Balances, trades, deposits and withdrawals update on a schedule, and the key's permissions are checked again every day.
What happens to a key after the check
Read-onlyThe key is accepted. Binance, Bybit, OKX, KuCoin and Coinbase report its permissions themselves.
Permissions unknownKraken and WhiteBIT don't report a key's permissions. The key is saved once you confirm it is read-only.
Trading or withdrawalsThe key is refused, and the app asks you to create a new read-only one. If such rights appear later, syncing stops until you replace the key.
Crypto walletsthe public address only
1You paste an address on an EVM chain or Solana, or an ENS name. Nothing to sign: the wallet is watch-only.
2To prove the wallet is yours, sign a message in your wallet. The signature moves nothing and costs no gas.
3Holdings, DeFi positions on EVM chains and the history come through Zerion. Spam tokens are hidden.
We hold no keys or seed phrases
A signature only proves ownership
A wallet is removed with one tap
03How the data is protected
Access keys are encrypted
Monobank access, exchange keys and AI connection credentials are encrypted with AES-256-GCM before they reach the database. The encryption key lives only on the server, and they are decrypted only to call the service.
Passwords only as hashes
The sign-in system stores passwords as hashes, never in clear text. One-time codes and the API keys you create in the app are stored the same way.
Transport and hosting
All traffic goes over TLS. The API, the web app, the database and Redis run in the EU, on Railway in Amsterdam, and backups stay in the same region.
Files are private
Receipts, attachments and avatars live in a private bucket. A link alone won't open them: the app streams a file only after checking that you may see it.
Deleted means deleted
Deleted records disappear at once. Only their identifiers stay in the sync feed, for up to 180 days, so your devices can reconcile.
04Who has access
In a shared space, a partner or family sees only the accounts you opened to them. New accounts stay hidden until you open them yourself.
You decide which accounts each member sees
The database enforces the limit with row-level security, so it holds the same for screens, Suricate, imports and sync
Viewers can look but not change anything
05Suricate and AI
Suricate works only when you ask, and uses only the parts of your records the answer needs. It saves nothing on its own.
Shows you every change first
Suricate only proposes drafts, categories and receipt lines. Nothing is saved until you confirm it, and unconfirmed proposals expire after 24 hours.
No training on your data
Suricate runs on Claude models by Anthropic, AssemblyAI transcribes voice, and Voyage AI handles short texts for category matching. All three providers are in the United States, and neither they nor we train models on your data.
What the providers never get
Passwords, session tokens, bank, wallet and exchange credentials, card and account numbers, other members' identities.
06How to delete everything
One connection
Disconnect Monobank, an exchange or a wallet in Settings, and its access is deleted. Imported transactions stay yours until you delete them.
The whole account
Deleting the account removes your records at once, and the host's backups keep them for no more than 89 days. It needs a recent sign-in and your email typed by hand, so nobody can do it in your place.
07Found a vulnerability?
Email security@degroshi.com with enough detail to reproduce it. We'll acknowledge within three business days and keep you informed. Please test only against your own data and give us time to fix the issue before disclosing it. There is no paid bug bounty yet.
