Security at Reeve Money

Information security policy · Last updated August 31, 2026

Reeve Money exists to keep one person's financial plan — which means it holds a position of unusual trust. This page documents how the product is secured today, in its beta, and the principles that carry into every future release.

Governance

Reeve Money is built and operated by Peach Byte Labs, LLC, a small team with direct ownership of every part of the system. Every architectural decision below is reviewed against this policy before it ships. Contact for security matters: support@reevemoney.com.

Data access is read-only, minimal, and never resold

• Account connections are made through Plaid and Apple's FinanceKit with read-only scopes. Reeve cannot move money, and bank credentials never touch Reeve's systems — they are entered only with the institution or Plaid.
• Reeve stores only what the product needs: transactions, balances, and investment holdings for the connected accounts.
• Financial data is used solely to provide the service to the account owner. It is never sold, shared with third parties, or used for advertising.

Encryption

• In transit: every connection to data providers (Plaid, Apple) and every client connection to this website uses TLS.
• At rest: each person's data lives in its own directory on an encrypted volume at Fly.io. On top of that, each person's database, plan and bank tokens are sealed with AES-256-GCM under a key that only their phone holds (in their iCloud Keychain). The server keeps that key in memory only while it is working for them; a restart forgets it and the phone supplies it again. A copy of the disk, a backup, or a shell on the server yields nothing readable.
• Who can read your data: the server, while it runs with your key, to sync your banks and keep your plan; Plaid and Anthropic, as the privacy policy describes. Not the developer: without your phone there is no key. If you want help with a problem, Settings > Privacy > Support access opens a 24-hour window in which support can look, and you can close it at any time.

Access control

• Each person's data is isolated per account: a separate database, plan and token store under a directory that only that account's requests can reach. Nothing is shared between people.
• Every API request is authenticated with a session issued by Sign in with Apple (Apple's identity token is verified against Apple's keys). Sessions are 256-bit random values stored only as hashes, expire after 90 days of inactivity, and can be revoked from the app. Nothing sensitive is written to logs or version control.
• The API is reachable only over TLS at a single address, with rate limits on sign-in and on the AI features. This public website is static content served from a CDN with no network path to the API.
• Provider credentials (API keys, access tokens) are rotatable at any time, and account connections are individually revocable.

Development and vulnerability management

• All code is version-controlled with an automated test suite (160+ tests) run before every deployment.
• Changes to security-relevant surfaces undergo adversarial code review before release; confirmed findings are fixed with regression tests before the change ships.
• Dependencies are minimal by design and updated regularly.

Incident response

On suspicion of compromise: affected tokens are rotated, provider connections revoked, the exposure assessed from audit logs, and the affected account owner notified without undue delay. To report a vulnerability, email support@reevemoney.com — reports are welcomed and answered.

Data deletion

Account connections can be severed at any time, and all stored data for an account owner is deleted on request.