Trust & security

When you connect a bank, Lait uses Enable Banking, a licensed Account Information Service Provider (AISP) under PSD2. The connection is read-only by law and by design: we see balances and transactions to build your dashboard, and we can never initiate a payment or move funds.

You authorize every connection on your own bank's login and consent screen. We never see or store your banking password. Lait caps each consent at 90 days; it never renews without you, and revoking it from Settings withdraws the consent at the bank side too, not just in our database.

Broker connections through SnapTrade follow the same rule: read-only, authorized by you, revocable.

Direct bank connections are rolling out gradually. Until they reach your account, bank data comes in through the statements you upload (CSV or Excel), which give Lait no access to your bank at all.

Data is encrypted at rest with AES-256 and in transit with TLS 1.3. Exchange API keys you add are encrypted a second time at the application layer (AES-256-GCM, with a key that lives only in the server environment) and are never returned by any API response. Wherever the exchange allows it, we ask for read-only keys, so even a leaked key could not move your assets.

Sign-in is managed by Clerk, a dedicated authentication provider; Lait never handles your password. Every request is scoped to your account: there is no shared view and no way to reach another user's data through the API. Administrative access is restricted to the platform operator, for support and maintenance only.

Your database is Neon Postgres in Frankfurt (EU). The application runs on Vercel: pages are served from the edge location nearest to you, and the server functions that process your requests run in Frankfurt (EU), next to the database. Some processors in the table are US companies (sign-in, email, error reports, payments, AI models); each of those transfers is covered by the EU Standard Contractual Clauses in our Data Processing Agreements. We list them plainly instead of claiming "100% EU".

As a European service we operate under the GDPR: you can access, correct, export or delete your data at any time. To exercise any right, write to privacy@lait.finance.

AI features are optional; Lait works completely without them. When you use one, we send only the minimum context the answer needs, and never your credentials. Before any transaction leaves for a model, we strip IBANs, emails, phone numbers and account numbers. We use these providers to answer you and for the checks our Privacy Policy lists, never for advertising. And nothing you share trains a model: every provider is used under its API terms, where inputs are not used for training. Your data is not the product, now or ever.

Your financial data is used only to build your portfolio, categorize your transactions and power the features you asked for. We do not use it for advertising or credit scoring, and we do not sell, rent or share it with advertisers or data brokers. The one profile we build is the support prioritisation our Privacy Policy describes: it never changes what you can use or pay, and you can object to it. The processors in the table are the complete list; reading a wallet or an exchange also means asking that service, with the public address or read-only key you gave us.

From Settings you can export everything you have in Lait as JSON or CSV, and delete your account. Deletion erases every row we hold about you, withdraws your bank consents at the bank side, removes any photos or documents you attached, and closes your sign-in account. No email, no waiting.

Found something? Write to security@lait.finance and a real person reads it. We do not run a bug bounty and we are not SOC 2 or ISO 27001 certified; we are a small team and will not pretend otherwise. What we will do is answer, fix, and credit you if you want. Our contact is also published at /.well-known/security.txt (RFC 9116).