Our approachPrivate by default. Defense in depth.
Norrith handles some of the most sensitive data you own, so we built it private by default and defense in depth. Your data is encrypted on your device and in transit, isolated per user at the database, and never sold or handed to advertisers. We use only standard, audited cryptography, with no home-rolled crypto.
Our security program is designed against the OWASP MASVS (Mobile Application Security Verification Standard) Level 2, and we are working toward SOC 2 readiness.
EncryptionEncrypted in transit and at rest.
In transit. Connections to Norrith's backend use certificate pinning, so a network attacker presenting a certificate we don't trust can't intercept or tamper with your data.
On your device. The local database sits under iOS Data Protection and stays unreadable while your device is locked. Authentication tokens live in the iOS Keychain: device-only, non-exportable, and never synced or backed up off the device.
iCloud sync is disabled, so your financial data doesn't leave the device except through authenticated API calls to our backend.
Bank connectionsRead-only, through Plaid.
Bank linking runs through Plaid. Your banking password is entered inside Plaid and is sent only to Plaid and your bank, so it never reaches Norrith. Access is read-only. Plaid access tokens never leave our servers and are encrypted at rest with AES-256-GCM, using a key that lives only in our edge functions and never in the database, with key rotation and purge on account deletion. Incoming bank webhooks are cryptographically verified before we act on them.
Backend isolationYour data is yours alone.
Row-Level Security runs on every user-owned table, so access is enforced at the database itself (owner = auth.uid()) and even an application bug can't expose another user's data.
Service-role keys and Plaid and AI provider keys live only in server-side functions and are never shipped to the app.
In a household, the database withholds a partner's private and balance-only transactions before they ever reach the other person's device. Sharing tiers are enforced server-side, not just in the UI.
AI privacyAI you control.
Norrith's AI features are off by default and consent-gated in Settings, under Privacy.
AI Insights sends category-level aggregates only, with no merchant names. Ask Norrith additionally sends your top merchants by recent spend so it can answer merchant-specific questions. A separate detailed mode opt-in is required before balances by type, itemized recent transactions, holdings, or split-partner names are ever sent.
Account numbers are never sent, and health and medical merchant names are withheld from the assistant, even in detailed mode. Processing runs on the provider's paid API tier, so your inputs are not used to train their models.
Data handling & complianceBuilt for Canadian privacy law.
Careful logging. Email addresses are masked in our logs, and amounts and tokens are never logged. Analytics and crash reporting are opt-in only and scrubbed of PII, with no balances, transactions, or account identifiers.
Your rights under PIPEDA and Quebec's Law 25. Full data export (JSON, plus a CSV of your transactions), correction, consent withdrawal, and deletion with a 30-day recovery window before permanent erasure.
Breach notification. If a breach materially affects your data, we notify affected users and the Office of the Privacy Commissioner of Canada without unreasonable delay. Full data-handling details are in our Privacy Policy.