Your financial data belongs to you
We built Mali so your documents are encrypted on your device before they ever reach our servers. Here's exactly how it works.
What happens when you upload a document
You select a file
You pick a bank statement, tax return, or any financial document from your device. Nothing has left your device yet.
Text is extracted in your browser
Your browser reads and extracts the text from the document entirely locally. The raw file never touches our servers.
On your device onlyYour browser encrypts it
The extracted text is encrypted using AES-256-GCM — the same standard used by banks and governments. The encryption key is derived from your Google account ID using PBKDF2 with 600,000 iterations. We never see the key.
AES-256-GCM · PBKDF2 · 600k iterationsOnly the encrypted blob is stored
We store a binary blob in our database that looks like random noise. An external attacker who breached our database would find only ciphertext — unreadable without your account key.
Ciphertext only · Unreadable without your keyWhen you chat or use voice
Your device fetches the encrypted blob, decrypts it locally, and sends the content to our AI provider (xAI Grok) to answer your question. The decrypted data exists in memory only for the duration of your session — it's never stored on our servers.
Decrypted on your device · Not stored by usWorks across all your devices
Sign in on your phone and your encrypted vault syncs automatically. The same key derived from your Google account decrypts it on any device you own.
Bank-connected accounts protect your data differently
When you connect a bank account (via Plaid), your login credentials never reach us. Mali requests read-only access, and Plaid passes verified account and transaction data to us over an encrypted channel. Here's where each piece of that data lives.
Your bank login never reaches us
When you link a bank, you authenticate directly with your bank inside Plaid's secure widget. Your username and password go from you to your bank, encrypted, through Plaid — never through Mali's servers. We only ever receive a read-only access token.
Credentials never touch our serversThe access token is sealed in Secret Manager
The read-only token Plaid issues is stored in Google Cloud Secret Manager, which encrypts each secret at rest with AES-256 (managed by Google Cloud KMS). No token is ever written to a plain database. It's used only to pull fresh account activity on your behalf.
AES-256 at rest · Google Cloud KMSSynced account data is stored in Firestore
The transaction history and balances we pull are stored in Google Cloud Firestore, which encrypts all documents at rest with AES-256 by default. This encrypted-at-rest storage is applied by Google at the storage layer — every record in our database is ciphertext on disk.
AES-256 at rest · FirestoreEncrypted in transit, isolated per user
All traffic between your device, our servers, and Plaid is encrypted with TLS 1.2+. And every account and transaction is scoped to your user ID by Firestore security rules — no one else can query it.
TLS 1.2+ · Per-user isolationWhat we never store
We never store your bank password, PIN, account number, or security questions. We store only the read-only access token (in Secret Manager) and the normalized account/transaction records needed to power your dashboard and Mali's answers.
No credentials · No account numbersSecurity by design
Every layer of the stack is built with your privacy in mind.
Google Cloud infrastructure
Hosted on Firebase / Google Cloud — SOC 2 Type II, ISO 27001, and PCI DSS certified. Google handles physical security, network security, and infrastructure patching.
Encryption with your account key
Your encryption key never leaves your device. It's derived from your authenticated Google account using AES-256-GCM and PBKDF2. We have no master key and no backdoor — but our staff with Firebase admin access could derive a user's key from their account ID, so this is not a fully zero-knowledge system. We're transparent about that tradeoff.
Per-user data isolation
Firestore security rules enforce strict isolation. No user can access another user's data — not even accidentally. Every read and write is verified against your authenticated identity.
TLS everywhere
All traffic between your device and our servers is encrypted in transit using TLS 1.2 or higher. Enforced by Google Cloud — no configuration required on our end.
Bank data encrypted at rest
Connected bank data never sits in a plain database. Access tokens are sealed in Google Cloud Secret Manager (AES-256 via KMS) and synced account/transaction records live in Firestore, which Google encrypts at rest with AES-256 by default. Your bank login itself never touches us — you authenticate directly with your bank through Plaid.
You control your data
Delete any document or your entire account at any time from Settings. Deletion is immediate and permanent — including the encrypted blobs and the salt used to derive your key.
Audit logging
Every data access event is logged. If you ever want a record of what happened with your data, it's there. Logs are retained for 12 months then automatically deleted.
Common questions
Straight answers, no marketing speak.
Can Mali read my bank statements?
No. Your documents are encrypted on your device before they reach our servers. We store ciphertext — binary data that's meaningless without your encryption key, which only you hold.
Is my connected bank data encrypted too?
Yes — at rest and in transit. Your bank login never reaches us (you authenticate directly with your bank through Plaid). The read-only access token is sealed in Google Cloud Secret Manager, and the synced accounts and transactions are stored in Firestore — both of which Google encrypts at rest with AES-256 by default. All traffic is TLS 1.2+.
Does Mali store my bank password or account number?
No. We never receive or store your bank password, PIN, or security questions, and we don't store full account numbers. Mali requests read-only access via Plaid and stores only normalized balances and transaction records needed to answer your questions.
What does the AI provider see?
When you ask a question, your device decrypts your documents and sends the relevant content to our AI provider (xAI Grok) to generate a response. It's processed per-request and your financial data is not stored by the provider. See xAI's privacy policy.
What if Mali gets hacked?
An external attacker would find only encrypted blobs and PBKDF2 salts. Without your Google account credentials to derive the decryption key, the data is computationally infeasible to decrypt — AES-256-GCM has never been broken. Note: a sophisticated attacker who also compromised our Firebase admin credentials could derive user keys from account IDs (this is the limitation of UID-derived keys; a real zero-knowledge system would require a user passphrase). We're working on a passphrase-based opt-in for users who want true zero-knowledge.
What if I lose access to my Google account?
Your encrypted data would be inaccessible — this is the tradeoff of account-key-based encryption. We recommend ensuring your Google account has recovery options configured.
Do you sell my data?
No. We don't sell your data — see our Privacy Policy. Your financial data is encrypted before it reaches our database.
How do I delete everything?
Open the app → Settings → "Delete all my data." This permanently removes all your documents, conversation history, and encrypted blobs from our servers. It takes effect immediately.
Ready to try it?
Your financial data stays yours. Always.
Open MaliMoney →