Data & Security

How your account is protected

• Passwords are stored only as salted one-way hashes (bcrypt), never in plain text. New passwords are checked against publicly known breached passwords using a privacy-preserving lookup.
• Two-step verification is required for every account, using a passkey (such as Face ID, Touch ID or Windows Hello) or an authenticator app, plus one-time backup codes.
• Sign-in sessions are stored in encrypted, HTTP-only cookies. You can see every signed-in device on your Security page and sign out any of them. Sessions end after 7 days without use.
• Repeated failed sign-in and verification attempts are rate limited.
• Sensitive changes, like adding a passkey, changing your recovery email or creating new backup codes, require you to have verified recently with a passkey, authenticator app or backup code.
• Everwise doesn't use phone numbers or text messages for sign-in or recovery.
• You'll receive email alerts for new sign-ins and important security changes, and can review recent security activity in Settings.

How information is protected

• Connections to Everwise use HTTPS.
• Sensitive stored fields, such as your name, authenticator keys and security activity details, are encrypted with AES-256-GCM before they're saved. Backup codes and reset links are stored only as hashes.
• API keys, encryption keys and other secrets are kept server-side and are never exposed to your browser.
• For connected banks, Everwise stores no bank access token; the Stripe identifiers it keeps, connected account names and transaction descriptions are encrypted with AES-256-GCM before they're saved. Everwise doesn't receive bank passwords or full account numbers.
• The web app uses a strict Content Security Policy and other browser security headers to reduce the risk of malicious scripts and clickjacking.

Third-party providers

Everwise relies on established providers for hosting, databases and email delivery. Bank connections are handled by Stripe, so Everwise never receives your bank password, and access is read-only. You can disconnect a bank at any time in Settings, which revokes access at Stripe and deletes that bank's data from Everwise.

What you can do

• Use a strong, unique password or a passphrase, ideally from a password manager.
• Use a passkey where your device supports it. It's the strongest option available.
• Keep your backup codes somewhere safe, and create new ones if you think they've been exposed.
• Keep at least two recovery methods, such as passkeys on two devices, an authenticator app, backup codes and an optional recovery email. If you lose all of them, Everwise may not be able to restore your account, because support can't bypass your security settings.
• Complete the Security Checkup when we ask (about every 90 days, and after security changes).
• Review security alert emails, and sign out other devices if you see activity you don't recognize.
• Remember: Everwise will never ask for your password or codes by email or phone.

An honest note

No system is completely secure, and we can't guarantee that information will never be accessed without authorization. Everwise has not yet completed independent security certifications or audits. We'll only describe certifications here once they've actually been completed.

To report a security concern, contact security@myeverwise.com.