- Home
- Security
Security of your financial data
Sending a bank statement takes trust. Here is, plainly, what Categorizei does to protect your data, what it does not do, and how you can check it.
Start free trialYour data, under your control
You decide what you send and you can delete it whenever you want.
- We only read the file you sendYou download the statement from your bank and send the file to Categorizei. We do not ask for your bank password and we do not log in to your bank account.
- You delete an import whenever you wantIn the “Imported files” tab, the Delete button removes that file’s transactions from the system.
- You can delete your accountIn Settings, on the My Account tab, the “Delete my account and all data” option deletes the company and everything that depends on it. The exception is the payment history, which is kept for the period required by law, as the Privacy Policy explains.
- You can take a copy of your dataYou can download a full backup of your data, protected by a password you choose on the spot, and restore it later.
- Each company only sees its own dataOne company’s data is kept separate from every other company’s. Automated tests try to read another company’s data and are required to fail.
- An idle account does not keep data foreverIf the account has no access at all for 3 months (6 months, for those who have already paid), we notify you by e-mail before discarding the data. Any access stops the process.
How we protect it
What exists today, one measure at a time.
- Encrypted connectionCategorizei uses HTTPS, the browser’s encrypted connection. The site also tells the browser to open it only over that connection for 1 year (HSTS).
- Your password is never readableYour account password is stored already scrambled (hashed), never as plain text.
- Two-step verificationYou can turn on, in Settings > My Account, a code generated on your phone that is asked for in addition to the password. On the system’s administration accounts it is mandatory.
- A brake on mass attemptsAfter 5 wrong passwords in a row, login for that e-mail is blocked for a while. Sign-up, password recovery and contact also have an attempt limit.
- Service keys stored encryptedThe keys the system uses to talk to services such as payments and e-mail are stored encrypted in the database.
- Daily backup, encryptedEvery day the database is copied and the copy is encrypted: without the key, the file does not open. If the key is not configured, the copy is not even created.
- Your card does not go through CategorizeiPayment is made on the Mercado Pago page. Categorizei neither asks for nor stores your card number; it only keeps the charge history (amount, date and status).
- System screens without other sites’ programsAfter you sign in, Categorizei’s screens do not load programs (scripts) from other sites, and the browser’s security policy blocks that kind of loading. On the site’s public pages, Meta ad measurement may be active; this is explained in the Privacy Policy.
- Security tests before every updateThere are more than 100 documented security rules and more than 300 automated security tests. They run before every system update (one of them, for example, tries to read another company’s data) and, if any fails, the update is not sent.
- Weekly check and alertEvery week, an automatic check looks at the live site the way an intruder would (protection headers, internal files closed, screens that require login) and looks for known flaws in the libraries we use. If any check fails, the administrator receives an e-mail alert.
Who looks after it
- Where the data is keptAccording to our Privacy Policy, the system’s data is kept on a server in Brazil, in São Paulo. The Policy also lists the providers that take part in the service, such as payments, e-mail and site protection.
- The rules in writingPrivacy Policy · Terms of Use
Questions or something odd?
To ask a question or report a possible security flaw, write to [email protected].
An honest note
No system is impossible to break into, and Categorizei is no exception. What we do is reduce risks with the measures above and check security every week. If an incident with relevant risk to you happens, we notify the affected people and the ANPD (Brazil’s data protection authority), as the law (LGPD) requires.
Try it with this month’s statement
Free for 20 days or up to 300 transactions, whichever comes first. No credit card.