What Pennyweight can and can't see

Pennyweight encrypts your financial data with a key that comes from your passphrase. This page explains when Pennyweight's servers can use that key, what stays readable without it, and how to cut off access.

Read How Pennyweight works first if you're new.

Your key starts in your browser

When you unlock, your browser turns your passphrase into a key. The passphrase itself isn't part of what your browser sends to Pennyweight. That key opens a private key, which opens your workspace key. Your workspace key encrypts your data.

Pennyweight's servers store your secret keys only in wrapped form. Your browser keeps its own unlocked copy so you don't have to unlock on every visit. The copies kept with your account can't be opened without your passphrase or your recovery code. The session copies described below are the exception. If you lose both your passphrase and your recovery code, your data is permanently unrecoverable.

When the servers can decrypt

Pennyweight's servers decrypt your data only through a session.

• Web session. When you unlock on the web, your browser gives the servers a session copy of your workspace key and your private key. With these, the servers can open bank transactions that arrived while you were away. Both copies are locked with a session key, which Pennyweight protects with AWS Key Management Service (KMS). It expires 90 days after the session was last used.
• AI connection. Authorizing an AI also asks for your passphrase and creates the same kind of session copy. It expires 30 days after your AI last used it. See my AI lost access to Pennyweight.

During a session, the servers decrypt for work such as answering your AI and syncing your bank. When you browse transactions on the web, your browser decrypts them.

Bank sync while you're away

New bank transactions can arrive when no session is open. For this, Pennyweight keeps a second copy of each bank connection's access token, encrypted with KMS. It's the one credential the servers can use without you.

A background job uses that copy to fetch new transactions. It seals each one to a bank-feed key for your workspace before storing it, and it can't read them back. The private half of that key is stored encrypted under your workspace key, so a session that holds your workspace key can open them. Transactions staged before your workspace had this key open with your private key instead. They join your ledger at your next web or AI session. See How bank connections are secured.

What stays readable

Some details stay readable so the service can sort, link and bill without your key:

• On each transaction: its date, ledger, category, account reference and currency, plus a pending flag on bank transactions.
• In the activity log: which action ran, when, and which records it changed.
• On a bank connection: your bank's Plaid identifier.
• Your display currency: the currency code you chose for totals across ledgers, if you chose one.
• Billing: your plan status and Stripe customer reference. You enter card details on Stripe's checkout page.
• Sign-in: your email, password and two-factor are handled by Clerk, Pennyweight's sign-in provider.

These stay encrypted: merchant names, amounts, notes and splits; account names, balances, last four digits and bank names; ledger names; and the reasons and details in the activity log.

How to do it

To cut off access:

1. Revoke an AI. Open Settings → Connect your AI. Under Connected AI clients, click Revoke, then Confirm revoke. That connection's session copy is deleted right away. See Manage and revoke AI access.
2. Lock or sign out on the web. Open Settings → Security and use Lock or Sign out. Both delete the keys stored in your browser. Neither deletes the web session copy on the servers. It expires 90 days after its last use. See Lock vs sign out.

What you'll see

Settings → Security opens with "Your data is encrypted with a key derived from your passphrase." After you confirm a revoke, the connection list reloads from Pennyweight's server.

Good to know

• Bug reports are readable by the team. Before your AI files a bug report or feature request, Pennyweight returns a scrubbed preview and needs a confirmation. Your AI is told to show you that preview. The scrub catches common formats of card and bank account numbers, Social Security numbers, email addresses, US phone numbers and amounts written with a dollar sign. The report isn't encrypted with your key, and your identity is replaced by an anonymous reference. Names aren't removed automatically, so check the preview. See Report a problem.
• Emails carry nothing about your money. Pennyweight's emails are about your account and subscription, plus a notice when an alert set to email fires. They never include a balance, a transaction, a merchant, an amount or a ledger name. The alert notice says only "You have new Pennyweight alerts"; your AI can show you the details.
• Your AI provider sees what your AI reads. Answers go to your AI decrypted. See What your AI provider sees.
• Your AI can't move money. See Your AI can't move money.