Security Built Around Your Account

Spendly brings account protection and security settings into your financial workspace. Choose the sign-in method that fits you and review your controls from Settings.

Sign in with a passkey

Passkeys use your device’s authentication, such as Touch ID, Windows Hello, or a hardware security key. The credential is tied to the service domain, helping protect sign-in against phishing.

Manage your registered passkeys in Settings and keep a recovery route available for your account.

Add two-factor authentication

Authenticator-based two-factor authentication adds a second step to password sign-in. Spendly supports standard TOTP authenticator apps and single-use backup codes.

Store backup codes somewhere you can access if your usual device is unavailable. Review your setup when changing devices.

Choose how you sign in

Spendly supports password sign-in, passkeys, and Google or Apple sign-in. Passwords are stored as bcrypt hashes. Two-factor secrets receive application-level encryption, and backup codes are hashed.

Authentication sessions use protected cookies. Sign-out invalidates the session token server-side, and account deletion disables authentication and revokes access.

Account controls in one place

Open Settings to manage account security, change your sign-in details, export records, or delete your account. CSV exports cover accounts, transactions, categories, budgets, and investments.

The privacy policy describes data handling and retention. Keep your sign-in method and recovery information current as part of a regular account review.

Report a security issue

Email [email protected] with a description and steps to reproduce the issue. Share the report privately so the team can investigate and address it.

For account access help, write to [email protected].