Security and privacy
You are trusting us with the most private numbers in your life. Here is exactly how they are handled.
Signing in
- Passwords are hashed with scrypt; we never store or see them.
- Optional two-factor codes (TOTP) with replay protection, and lockout after repeated failed logins.
- Sessions use HttpOnly, SameSite cookies, with CSRF and origin checks on every change.
- A passcode lock and a privacy blur hide figures when someone is looking over your shoulder.
Your data
- Data is encrypted in transit between your browser and Mintage.
- Every change is written to an audit log you can read.
- Each entity has its own permissions: owner, editor, viewer or accountant (read and export only).
- Input is validated at every boundary and attachments are stored outside the web root.
What we never do
- We do not sell your personal information and we do not use your financial data for advertising.
- No ads, ever.
- Bank feeds use the provider's consent flow; we never ask for your internet banking password.
Leaving is easy
Download a full backup at any time, export every report as CSV (and Excel or PDF on Investor and Business), or delete your account from Settings.
Run it yourself
Mintage can run on your own computer or server as a single app with Docker. In that case your data never reaches us.
Found a problem?
Please report security issues privately through the help centre and we will respond quickly.
Your money data stays yours
Locked down
Encrypted connections, passwords hashed with scrypt, optional two-factor codes and login lockout after repeated failures.
Never sold
No ads, no selling or sharing your data with marketers. You pay for the product, so you are not the product.
Export everything
Download a full backup, every report as CSV, Excel or PDF, and an accountant pack. Leaving is one click.
Or run it yourself
Prefer your own computer? Mintage runs as a single self-hosted app with Docker, and your data never leaves your machine.