Duolign handles two people's real financial data. Here's specifically how it's protected — not a marketing summary, the actual mechanisms.

Encryption

All traffic between the app and our servers runs over TLS. Data at rest — your household's balances, transactions, bills, and every other record — is encrypted using AES-256, provided by our database infrastructure (Supabase, on AWS).

Account & device security

• Sign-in is handled by Supabase Auth (email + password, or your chosen provider).
• The app can be locked with Face ID, Touch ID, or Android biometrics, with a device PIN as the fallback — set once per device, never sent to our servers.
• A joint decision — changing a shared target, for example — requires a confirming tap from both partners' devices before it takes effect.

You can erase everything yourself, on demand

From Settings, you can permanently delete your household (every record, for both of you) or just your own account (your login and private data; your partner's data stays intact for them, if they've joined). Both are real deletions, not a flag that hides the data while it's kept around: the data is permanently erased 30 days later, and until then you can change your mind and cancel from the same screen.

Infrastructure

Duolign is built on a small number of established providers, each processing data only as needed to run the service:

• Supabase (database, authentication, encrypted file storage) — hosted in the EU.
• Railway (the servers that run the app) — hosted in the EU.
• RunPod — runs the AI model that reads statements from banks without a dedicated parser, on EEA servers only, seeing only redacted statement text.
• Google Firebase — push notification delivery only.
• Resend — email notifications when you contact us (your email address and message only, never financial data) — based in the US.
• RevenueCat — in-app Premium subscriptions (your household's ID and the store's purchase record, never financial data) — based in the US.
• Sentry — crash and error reports, so we can fix problems — hosted in the EU.

Reporting a security issue

If you believe you've found a security vulnerability in Duolign, please tell us before telling anyone else: security@duolign.co.uk. We take reports seriously and will respond promptly.

See also our Privacy Policy and Terms of Service.