How your data is protected

liway connects to your bank to show what's safe to spend before payday. That means we handle sensitive financial information, so here's a plain-language account of how it's secured, who can access it, and what we promise.

Your bank login is never ours to see

When you connect a bank, the login happens inside Plaid, our bank-connection provider. liway never receives, sees, or stores your bank username or password. The connection is read-only — liway can read balances and transactions to do its job, and cannot move money.

Is my data encrypted?

In transit: every connection uses HTTPS / TLS 1.2 or better, with HSTS enforced across all liway domains. Data moving between your device and liway is encrypted.
At rest: our database runs on a managed provider with SOC 2 Type II controls and volume-level encryption at rest.
Your bank access token (the key Plaid issues so liway can refresh your balances) is additionally encrypted by liway with AES-256-GCM before it's stored — encrypted on the way in, decrypted only when needed.
Passwords are stored only as bcrypt hashes; we never keep your plain-text password. On your phone, login tokens live in the device's secure enclave (iOS Keychain / Android Keystore).

Can liway read my financial data?

Yes — and we want to be straight with you about it. To calculate your leeway, liway's servers read your balances and transaction history. liway is not end-to-end encrypted, which means we are technically able to access this data to operate the service. We don't pretend otherwise.

What we do with that ability is the part that matters:

We use your data only to detect your paycheck, bills, and spending and show your leeway. Individual transactions aren't put on display.
We never sell your data, and liway has no ads and no third-party advertising or tracking SDKs.
Our internal admin tools never expose your financial data — balances, transactions, bills, and bank details are off-limits there by design.
Access to production systems is restricted to authorized personnel with multi-factor authentication, and deploys run only through automated CI — no one runs production deploys by hand.

You're in control

You can delete your account and all associated data at any time from Settings. Deletion requires your password, a one-time email code, and a type-to-confirm step — and it revokes the bank connection at Plaid.
Email verification at sign-up gates access to any authenticated feature, including bank linking.

Learn more

For the full detail on what we collect and why, see our Privacy Policy. Questions about security? Email connect@liway.app.

Last reviewed: July 26, 2026. We review this page whenever a release changes how data is collected, stored or shared, and at least once a quarter.