Fimerse Security

Last updated: 2026-08-16

This page explains, in plain language, how Fimerse protects your money data. The legal detail lives in the Privacy Policy; this is the practical story. Questions or reports: support@fimerse.com.

We never ask for your bank login

Fimerse works by reading statements you choose to upload: a PDF, image, CSV, or pasted text. There is no bank "connection", no aggregator, and no screen-scraping. We never see your banking credentials, so there are no banking credentials for us to lose.

Statements are read, then thrown away

When you upload a statement, our AI extracts the transactions and the file is **deleted from our servers after extraction**. We keep the numbers, the transactions and balances that end up in your ledger, not the documents. Statement files are processed in a restricted temporary workspace on an encrypted volume, never in a public or shared location.

If your PDF is password-protected, the password you type is used once to unlock the file for extraction and is never stored and never exposed to other processes on the server.

Your data, encrypted and isolated

• Encrypted in transit. Everything travels over HTTPS, enforced with HSTS.
• Encrypted at rest. The database and the statement-processing workspace live on an encrypted storage volume.
• Isolated per user. Every request is authenticated and scoped to your own account at the database-query layer. Users cannot see each other's data.
• Passwords hashed with scrypt, a modern memory-hard algorithm. Session, reset, and verification tokens are stored hashed too, never in plain text.
• No trackers. Loading Fimerse makes no third-party requests at all: no analytics scripts, no ad pixels, no external fonts. Our strict Content-Security-Policy enforces this in your browser, not just in policy. You may notice we have no cookie popup. That is because there is nothing to consent to.

Backups that survive a bad day

The database is continuously replicated to encrypted off-site storage, so a server failure doesn't take your ledger with it. Backups are retained for a short rolling window (currently 7 days), which also means deleted data ages out of backups quickly.

You can leave, completely

Deleting your account is built into the app and removes your data, not just your login: accounts, transactions, budgets, goals, and chat history all go. Residual copies age out of the encrypted backups within the retention window above. Details in the Privacy Policy.

Who else touches your data

Only the subprocessors we need to run the service: Anthropic (AI extraction and advice), Resend (transactional email), our hosting provider, and Cloudflare R2 (encrypted backups). The full list and what each one sees is in the Privacy Policy. We do not sell your data, and it is not used to train AI models.

Found something?

If you believe you've found a security issue in Fimerse, please email support@fimerse.com with the details. We read every report and will respond quickly. Please don't access other users' data while demonstrating an issue.