GetGild is built on a zero-knowledge architecture. We cannot read your financial data even if we wanted to. Your encryption key never leaves your device.
Separate encryption keys for live data, backups, and disaster recovery, all managed with dedicated, customer-controlled keys stored in a hardware-backed key management service.
All traffic is encrypted with TLS 1.2 or higher. TLS 1.0 and 1.1 are not supported. HSTS is enforced with a one-year max-age including subdomains.
All databases use AES-256 with dedicated, customer-managed keys: separate keys for live data, backups, and disaster recovery. Audit log storage is WORM-protected (write-once-read-many) to prevent tampering.
Our logging policy prohibits recording passwords, JWT contents, financial amounts, names, or addresses. Logs reference resource IDs only, keeping your personal data out of operational systems.
Zero real production data in dev or staging. Staging uses masked snapshots: emails replaced, transaction amounts randomised ±20%. Masking runs in an isolated environment with no internet access.
Automated daily backups with 35-day retention. Weekly cross-region replication with a separate encryption key. Manual snapshots are taken before every major deployment.
Short-lived tokens, strict role separation, and hardware-enforced MFA for all privileged access.
JWT access tokens expire in 15 minutes, signed with RS256 using a private key stored in a hardware-backed secrets vault. Refresh tokens (7-day TTL) are stored as httpOnly, Secure, SameSite=Strict cookies and can be server-side revoked.
Every account uses four roles: Owner, Admin, Editor, Viewer. These are enforced at both the API layer and at the database level using PostgreSQL Row-Level Security. Queries are always scoped to the authenticated user.
Zero secrets in source code or environment variables. All credentials are fetched from a hardware-backed secrets vault at runtime. Database passwords rotate automatically every 90 days. CI pipelines are scanned for accidentally committed secrets on every build.
Emergency database access requires dual approval (CTO or Head of Security), issues a time-limited role for up to 4 hours, and logs every action to an immutable audit trail. A post-incident review is mandatory after every activation.
All privileged infrastructure access requires MFA (hardware TOTP or WebAuthn preferred). CI/CD pipelines use short-lived federated credentials instead of long-lived static keys. The break-glass role requires MFA plus out-of-band approval.
Every service, function, and engineer has only the permissions they need. Access policies are scoped to specific resources, never wildcards. Peer review is required for all access policy changes.
GetGild uses TrueLayer, an FCA-authorised Payment Institution, for all Open Banking connections. Your bank credentials are never shared with GetGild.
OAuth tokens are encrypted with your personal encryption key and stored as ciphertext. During a sync, the token is decrypted transiently in an isolated serverless function and discarded immediately after use. It is never persisted in plaintext.
Every API call, infrastructure change, and network flow is logged. Automated alerts fire within minutes of anomalous activity.
Every infrastructure API call is captured with identity, timestamp, and IP, retained for 1 year with cryptographic log file validation. Application audit logs record every write operation. Audit log storage is WORM-protected to prevent tampering.
Network flow logs capture source IP, destination, port, protocol, bytes, and allow/deny decision for all traffic, retained for 90 days online and 1 year in cold storage. Threat intelligence signals are correlated continuously against network flow data.
Our zero-knowledge architecture directly satisfies the technical measures required by UK GDPR Article 32. Encrypted data in a breach is not personal data in any meaningful sense.
Data is hosted exclusively in ISO 27001-certified UK data centres. Our architecture implements Article 25 (Privacy by Design) and Article 32 (appropriate technical measures). We hold a formal data classification policy and processing register.
Account deletion triggers a hard delete across all tables within 30 days: users, linked accounts, transactions, assets, and tax records. Audit logs retain pseudonymous tombstone IDs only for up to 7 years for fraud and compliance purposes.
We log resource IDs, never contents. Financial amounts, names, and addresses never appear in operational logs. Our open banking integration stores OAuth tokens as encrypted blobs. GetGild staff cannot read your bank data.
We welcome responsible disclosure from the security research community. If you've discovered a vulnerability, please contact us before public disclosure so we can investigate and remediate.
We aim to acknowledge reports within 2 business days and resolve critical issues within 14 days. We will not take legal action against researchers who act in good faith.
✉ Report a vulnerabilityTo help us triage quickly, please include:
Please do not access, modify, or delete data belonging to other users. Testing should be limited to your own account.