Security
What we don’t have, nobody can lose.
Your platform never sees a bank PIN. By default we don’t store it either. And before a partner sees anything, they are reviewed.
Credentials
- PIN not stored by default
- Only if the end customer explicitly chooses it, it is kept encrypted in the vault for automatic retrieval. We delete it immediately on withdrawal.
- Partners never see credentials
- Not in the API, not in webhooks, logs or error messages. Automated tests check this.
- Encryption
- Credentials and documents are stored encrypted with AES-256-GCM in the database and stay encrypted in backups.
Consent
- The end customer decides
- They read which data goes to whom and pick the accounts themselves. The partner’s name, Agile Finance and our company are visible on the page.
- At most 180 days
- After that the consent expires. Your platform learns about it in advance via webhook.
- Every change in the log
- Who, when, which text version, IP address shortened. Withdrawal applies immediately and is possible at any time.
The connect flow
- One-time link
- Valid for 30 minutes, stored only as a hash, with its own rate limit per link.
- No third-party scripts
- Strict browser security rules: no support widget, no error reporter, no embedding, no caching, no referrer.
- Input via POST only
- PIN and TAN never appear in an address and are cleared in the browser right after sending.
Platform
- Tenant separation
- Every query carries workspace and environment. Foreign IDs result in “not found”. Sandbox and live never mix.
- Signed webhooks
- HMAC-SHA256 with timestamp. Your server checks that a delivery really comes from us.
- Keys per environment
- API keys belong to exactly one environment, with individually chosen permissions. MCP access via OAuth 2.1, the tools read, create connect links and trigger fetches.
- Data minimisation
- IP addresses shortened, retrieval logs deleted after 90 days, deleting an end customer removes all their data for good.
Location and operation
- Servers in Germany (Nuremberg)
- The provider is a German company. Bank data and documents are kept on our servers in Germany.
- Documents protected separately
- Proofs of business are encrypted, only reviewers and workspace admins have access, and every access is logged. ID images do not stay with us.
Every partner is reviewed
Identity check of the authorised representative, proof of business and a decision by our team. Without approval there are neither API keys nor a sandbox. Blocked partners immediately lose retrieval and webhooks.
Report a vulnerability
Found a vulnerability? Write to info@agiledeveloper.de. We answer personally and treat your report confidentially.