Security

At Coney, we understand that trust is earned, especially when it comes to your finances. That's why we've built security into the very foundation of our platform. We want you to feel completely confident and secure using Coney, knowing your data is protected every step of the way.

Encryption and Account Protection

All communication between your device and our servers is encrypted using HTTPS (TLS), the industry standard for secure data transmission. Your password is never stored in plain text: it is hashed with a strong, one-way hashing algorithm. Database backups are encrypted at rest, so your data stays protected even in backup storage.

You can further protect your account by enabling two-factor authentication (2FA) in your profile settings: in addition to your password, you will be asked for a time-based one-time code from your authenticator app. Recovery codes are provided in case you lose access to your device.

Your Data, Your Control

We firmly believe that your data belongs to you and you alone. We will never sell or trade your personal data, and we don't use analytics or advertising cookies on our website. Your data is shared only with the small set of providers listed below, strictly as needed to run the Service, as described in our Privacy Policy.

Access Controls: Maintaining Data Integrity

Access to production systems and user data is limited to the operator, happens only when necessary to run the Service, to provide support you have requested, or to handle incidents, and is kept to the minimum necessary. We don't use third-party contractors or administrators.

Our Trusted Partners

We carefully select a very limited number of trusted partners to help us deliver the best possible service. These partners are essential to running our applications and meet our high security standards:

• Ionos: Cloud services provider (application and database hosting, within the European Union).
• Stripe: Secure payment processing for the Lifetime Plan.
• GoCardless (Bank Account Data): Secure bank transaction import for users with Bank Sync Access. Coney never sees or stores your online banking credentials — you authenticate directly with your bank through GoCardless.
• Cloudflare: DNS, DDoS protection, and anti-bot protection on signup and contact forms.
• Rollbar: Helps us monitor application performance and identify potential issues.
• Google: Google Drive/Sheets sync — only if you connect your own Google account. Your expense data goes to your own spreadsheet, under your control.

Report a Security Issue

If you believe you have found a security vulnerability in Coney, please let us know by emailing [email protected] (subject: "Security"). We take every report seriously and will work with you to understand and address the issue. We kindly ask you to give us a reasonable amount of time to fix the problem before any public disclosure.

We're Here for You

Your security and peace of mind are our top priorities. If you have any questions or concerns about security at Coney, please don't hesitate to reach out to us at [email protected]. We're always happy to help.