Duolign handles two people's real financial data. Here's specifically how it's protected — not a marketing summary, the actual mechanisms.

Encryption

All traffic between the app and our servers runs over TLS. Data at rest — your household's balances, transactions, bills, and every other record — is encrypted using AES-256, provided by our database infrastructure (Supabase, on AWS).

Open Banking: read-only, by construction

Bank connections go through an FCA-authorised Account Information Services Provider (AISP). This is an Account Information connection, not a Payment Initiation one — the permission model itself makes it impossible for Duolign to move money, only to read balances and transactions you've explicitly authorised.

Authorisation happens on your bank's own login page, using their standard secure sign-in (including your bank's own 2-factor step). Duolign never sees, asks for, or stores your online banking username, password, or PIN. You can revoke access at any time, in your banking app or in Duolign's Settings, and it takes effect immediately.

Your private data stays private — enforced at the database, not just the screen

If you mark an account private, it isn't just hidden in the interface: it's stored in a separate, per-user partition of the database that your partner's login is structurally unable to query, even directly. A UI bug or a future feature can't accidentally expose it, because your partner's session has no path to that data at all.

Account & device security

• Sign-in is handled by Supabase Auth (email + password, or your chosen provider).
• The app can be locked with Face ID, Touch ID, or Android biometrics, with a device PIN as the fallback — set once per device, never sent to our servers.
• A joint decision — changing a shared target, for example — requires a confirming tap from both partners' devices before it takes effect.

You can erase everything yourself, on demand

From Settings, you can permanently delete your household (every record, for both of you) or just your own account (your login and private data; your partner's data stays intact for them, if they've joined). Both are immediate, real deletions — not a flag that hides the data while it's kept around.

Infrastructure

Duolign is built on a small number of established providers, each processing data only as needed to run the service:

• Supabase (database, authentication, encrypted file storage) — hosted in the EU.
• Our Open Banking AISP partner — the regulated bank-connection layer.
• Google Firebase — push notification delivery only.

Reporting a security issue

If you believe you've found a security vulnerability in Duolign, please tell us before telling anyone else: security@duolign.co.uk. We take reports seriously and will respond promptly.

See also our Privacy Policy and Terms of Service.