Security is a core principle at Rainty. As a financial application that connects to users' bank accounts, we apply strict security practices at every layer of the product — from how data is transmitted to how it is stored and accessed.
🔐
Encryption
All data in transit is encrypted using TLS 1.2+. Sensitive data at rest is encrypted using industry-standard algorithms.
🏦
Read-Only Banking
Rainty never stores your banking credentials. Access is read-only via licensed Open Banking APIs.
🛡️
Access Control
Strict access controls ensure only authorized processes can access financial data. No human operator accesses raw transaction data.
🔍
Regular Reviews
Security practices are reviewed regularly throughout the development cycle, with vulnerability assessments planned before launch.
Data Transmission
All communication between your device and Rainty's servers is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints and reject insecure connections.
Bank connectivity is handled entirely by Enable Banking, a licensed Open Banking provider operating under PSD2 regulation. Authentication with your bank uses your bank's own secure environment — Rainty never sees your banking password or credentials.
Data Storage
Financial data retrieved from your bank is:
- Stored in encrypted form at rest
- Accessible only to authenticated application processes
- Never sold, shared, or used for advertising purposes
- Retained only as long as necessary per our Privacy Policy
Authentication & Access
User authentication in Rainty is designed with the following principles:
- Passwords are hashed using bcrypt or equivalent one-way hashing
- Sessions use short-lived, cryptographically signed tokens
- CSRF protection is enforced on all state-changing requests
- Multi-factor authentication (MFA) is part of the security roadmap
Open Banking Security
Rainty integrates with bank accounts exclusively through regulated Open Banking APIs under the PSD2 framework. Key security properties of this integration:
- Your bank credentials are never shared with or stored by Rainty
- Access tokens are short-lived and scoped to read-only permissions
- You can revoke Rainty's access to your bank at any time through your bank's settings
- All API calls to Enable Banking are made server-side over encrypted connections
Rainty has zero ability to move money. Our Open Banking integration is strictly read-only — we can only read transaction history and balances.
Vulnerability Disclosure
We take security reports seriously. If you believe you have found a security vulnerability in Rainty, we encourage responsible disclosure.
🔎 Report a Vulnerability
Please send a detailed description of the issue, steps to reproduce, and potential impact to our security team. We aim to acknowledge all reports within 48 hours.
security@rainty.app
We ask that you:
- Do not access, modify, or delete data that does not belong to you
- Do not disclose the vulnerability publicly before we have had a chance to address it
- Act in good faith to avoid disruption to the service
Planned Security Milestones
We maintain the following security controls and roadmap items:
- ✅ TLS encryption on all endpoints
- ✅ Read-only Open Banking integration via licensed provider
- ⏳ Third-party security audit
- ⏳ Multi-factor authentication (MFA)
- ⏳ Penetration testing
- ⏳ SOC 2 compliance assessment