Security
Last updated: April 2026
All bank connections use Plaid, an FCA-authorised open banking provider used by millions of people across the UK. We request read-only access only. We can see your transactions and balances. We cannot initiate payments, move money, or modify your account in any way. Your bank credentials never touch our servers.
All data is encrypted using 256-bit AES encryption at rest and TLS 1.3 in transit. This is the same standard used by major UK banks.
User authentication is provided by Firebase Authentication (Google). We use Firebase App Check to protect against bots and unauthorised API access. Multi-factor authentication is available and recommended.
Billing is handled by Stripe, which is PCI-DSS Level 1 compliant and FCA-regulated. We never store card numbers or CVVs.
Every user account is isolated by organisation. No user can access another user's financial data. Access controls are enforced at the database level, not just the application layer.
We comply fully with UK GDPR. You can export or delete all your data at any time by emailing privacy@manucci.ai. We do not sell your data to third parties.
If you discover a security issue, please email security@manucci.ai. We will acknowledge within 48 hours and respond with a resolution timeline.