Your money data, guarded like a bank's
Last updated: September 5, 2026
FinancialHealth.io (Udabyte LLC) handles your most sensitive financial information, and we're deliberate about protecting it. Below is exactly how — stated plainly, and with each certification attributed to whoever actually holds it. We don't claim credentials we haven't earned.
Encryption, specifically
Your data is encrypted with AES-256 at rest and TLS 1.2+ in transit. Not vague "bank-grade" language — the actual ciphers.
Bank connections via Plaid
Bank links are handled by Plaid. Your bank credentials go to Plaid, never to us — we receive a read-only token and cannot move money.
Payments via Stripe
Card payments are processed by Stripe, a PCI-DSS Level 1 certified provider. Your full card number never touches our servers.
Certified infrastructure
We host on cloud infrastructure that is independently certified to SOC 2 Type II and ISO 27001. Those are our provider's certifications.
Privacy-safe AI
Before any AI request, your name, account identifiers, and exact figures are anonymized. AI insights are informational only — not financial advice.
Controls you own
Multi-factor authentication, full data export, and account deletion are yours any time. We never sell your data.
An honest word on certifications
FinancialHealth.io does not hold its own SOC 2 or ISO 27001 audit, and we don't claim to. The certifications on this page belong to our infrastructure and to our payment and bank-data partners (Stripe, Plaid), and are attributed to them as such. As we grow, a third-party penetration test and then our own SOC 2 audit are on the roadmap — and we'll say so here only once each is actually complete.
Reporting a vulnerability
Found a security issue? We welcome responsible disclosures. Email [email protected] with the details and steps to reproduce.
Safe harbor: we will not pursue legal action against researchers who act in good faith — who avoid privacy violations and service disruption, don't access or modify data beyond what's needed to demonstrate the issue, and give us reasonable time to remediate before public disclosure.
Machine-readable contact: /.well-known/security.txt