There are two primary reasons why people choose to have their financial data aggregated.One reason would be to have a holistic, consolidated view of their personal finance. This view provides people with more control over their finances, which ultimately helps them to make better decisions and be better off.
Another reason individuals might want to consolidate their data would be to document their entire financial history. In this situation, the data itself becomes an asset because you can share it when applying to products or services that require a deeper understanding of your financial position.
Moneytree provides bank-level data security. Moneytree already has a dozen bank partners, all of which required full security audits, most even required on-site inspections prior to commencement of business.
Moneytree practices a policy called ‘privacy by design,’ meaning we only collect the minimum amount of information to provide our service.Unlike other service providers, Moneytree does not request age, gender, or other identifying data as part of account creation. So, all that’s required to sign up for Moneytree is an email address and a password the user sets.Beyond data required for registration, we do hold transaction data from our user’s registered accounts.
Moneytree was created with security, privacy, and transparency as core values. In this new era of connected banking, our commitment to these principles has become even more relevant.
With regards to security, we utilize industry best practices around preventing loss of data, including encryption and penetration testing.With regards to privacy, we believe that user data belongs to the user, and thus have strict rules about how, when, and where that data can be applied.Security and privacy would be nothing without transparency. A stand-out example of our commitment to transparency is the lengths to which we have gone in order to eliminate legalese from our terms and conditions and privacy policy. We speak in plain language, easy for anyone to understand.
Moneytree is a product company, not a data marketing company. We differ from other aggregators because our goal is to empower consumers, allowing them to choose when, where and how their data is shared. We do not engage in practices like selling “anonymised” customer data, or target customers with commercial offers.
Customers authenticate information themselves through the ownership of their financial products, including credit cards, bank accounts, or superannuation funds, using the same mechanisms of authentication they use with their product providers - generally a unique customer number and a password.To access any of this information via Moneytree, users first need to unlock their device. Once the device is unlocked, users can login to Moneytree with a username and password. If already logged in, users can unlock Moneytree using a passcode or biometric factors like fingerprints and/or facial recognition, depending on the mobile device they are using.
We abide to the principles considered in the Secure Coding Practices guide developed by the Open Web Application Security Project (OWASP), a worldwide not-for-profit organisation focused on improving the security of software. This guide defines practices to be integrated into the software development cycle and aimed at mitigating common vulnerabilities.Our company provides training to all its staff to ensure that these security and risk mitigating best practices are carried out constantly.
We host our service on Amazon Web Services (AWS) and Heroku, both widely acknowledged as industry-leading secure platforms; and, of course, we always use encrypted connections between our apps and our servers.
Just as banks audit security preparedness ahead of partnerships, we periodically test the security of our partners through a number of widely accepted methods. We carry out periodic penetration testing on all platforms and in all API connections to find vulnerabilities that an attacker might attempt to exploit.Partner security is critical to our business, and there have been instances where we have detected potential vulnerabilities with partner services. In those cases, we reached out, advised the partner of the issue, and requested they make the necessary fixes. In extreme cases, we may suspend the connection to a partner until we are confident they have remedied any potential problems.
We use SSL Pinning, a cryptographic protocol for increased app security which allows us to block man-in-the-middle (MITM) attacks.Through this protocol, we bundle a certificate with our apps to ensure that they are indeed talking to our servers and no one else. This way, the apps will refuse to communicate data to any server that does not recognise, preventing access from unauthorised parties.
The SSL Pinning protocol is simple to implement and we believe that this protocol should be an industry standard for all data aggregation services.Moneytree also encrypts data in flight using a cryptographic protocol called TLS (the successor of SSL) and we use platform-provided encryption for data at rest.
We work hard to stay abreast of all the latest potential hacks and vulnerabilities across the software industry. We are active participants in numerous working groups and forums, and we maintain close contact with our platform partners security teams.We were one of a very small handful of businesses in Japan that suspended services during the “Heartbleed” vulnerability of 2014. Unlike some market participants, we were transparent about the issue, using social media and emails to keep users informed. The biggest tech companies are often patched before vulnerabilities are disclosed.
In the case of Heartbleed, Moneytree deployed new SSL certificates for our servers and clients (user devices), which included submitting an updated version of Moneytree to the App Store. We ultimately only resumed service after confirming all our partners had patched their security as well.
CTO & Co-founder of Moneytree. Originally from New Jersey, Ross has spent the past 14 years in Tokyo. He is an influential technologist, often called upon to articulate global technical best practice to key players in Japan and Australia.
Ready to get started?
Try Moneytree now.
