Is my information secure with SuperMoney?

Yes. SuperMoney is SOC 2 Type II certified, your data is encrypted in transit and at rest on servers located only in the United States, and we never see your bank username or password.

Here is exactly how that works, because "we take security seriously" is not an answer.

We never see your bank login

When you connect an account, you are not handing your credentials to SuperMoney. You enter them with a regulated account-linking provider, and we never receive or store them.

We work with Plaid, MX, Finicity, Yodlee, and Akoya, connected through an orchestration layer called MoneyKit. These are the same providers used across the banking and fintech industry. They pass us the account data you have authorized, such as balances, transactions, and loan details. They do not pass us your login.

Connected accounts are read-only. SuperMoney can see your balances and transactions. SuperMoney cannot move money out of a connected account, cannot make a payment from it, and cannot change anything about it. Read access is all we ask for and all we have.

You can disconnect any account at any time.

How your data is protected

• Encrypted in transit and at rest. We use 256-bit SSL encryption to transmit data, and everything is encrypted at rest as well.
• US-based servers only. Your information is stored on secure servers located in the United States, behind firewalls.
• Payment data is never on our systems. Payment and related personal data is held in PCI-compliant, PA-DSS certified data centers rather than by us.

Who can see it inside SuperMoney

Almost nobody, by design.

• Role-based access control and least-privilege access. Employees can reach your information only where their job requires it.
• Background checks and NDAs for every employee and contractor.
• Ongoing security training and testing against current attack techniques.

How we check that it's working

• SOC 2 Type II certified, audited under AICPA standards. That is an audit of controls over time, not a one-time questionnaire.
• Continuous monitoring by Vanta, our third-party compliance platform.
• Annual penetration tests plus continuous vulnerability scanning of production systems.
• Infrastructure monitored by dedicated security personnel.

Full detail on our security practices →

The part we need you to handle

Most financial fraud does not involve breaking encryption. It involves someone convincing you to hand over information.

SuperMoney will never cold-call, text, or email you offering a loan or saying you have been approved, unless you have already taken action on supermoney.com or in the app. We will never ask for an upfront fee to release a loan, and we will never ask for your bank password.

If something arrives claiming to be us and you did not start the conversation, it is not us. How to spot it.