Security

Updated October 17, 2026

Ruckwise handles financial information, so we design for the assumption that every layer could be attacked. Here is how your data is protected.

On your iPhone

• Your data is stored with iOS Data Protection (hardware-backed AES-256 encryption).
• An optional 6-digit Ruckwise passcode, stored only as a salted PBKDF2-SHA256 hash (310,000 rounds) in the iOS Keychain, never backed up and never sent anywhere. Wrong attempts trigger escalating waits, with an optional wipe after 10.
• Optional Face ID or Touch ID, with automatic re-locking after a time you choose.
• The app hides its contents in the app switcher and, optionally, during screen recording or mirroring.
• Your sign-in token lives in the Keychain, tied to this device.
• Connections to our server must use HTTPS.

Bank connections

• You sign in to your bank through Plaid. Your bank credentials never reach Ruckwise.
• Our access is read-only. We cannot move money.
• Bank access tokens are encrypted with AES-256-GCM using a separate key, and are revoked at Plaid when you disconnect or delete your account.
• Messages from Plaid are verified by their digital signature before we trust them.

On our servers

• All traffic is encrypted with TLS (HTTPS), with HTTP Strict Transport Security.
• The entire database is encrypted at rest with AES-256. Backups stay encrypted.
• Passwords are stored only as bcrypt hashes and are checked against known breaches when chosen.
• Optional two-step verification (time-based codes) with one-time recovery codes. Codes can't be reused.
• Every sign-in is a revocable session. You can sign out all devices at once, and changing your password or turning on two-step signs out other devices.
• Sign-in attempts and request rates are limited to slow down guessing and abuse.
• Encrypted backups are taken daily.

Inside our company

• Administrator tools show account information only. They never show members' transactions, balances, budgets, or goals.
• Administrator access requires two-step verification, and every administrator action is recorded in a permanent, tamper-resistant audit log.
• Encryption keys are kept separate from the data and from our source code.

Reporting a vulnerability

If you believe you've found a security issue, please contact the support email listed on our App Store page privately with the details and give us reasonable time to fix it before disclosing it. Please don't access other people's data or disrupt the service while testing. We appreciate responsible disclosure and won't pursue action against good-faith research that follows these guidelines.