Ekstre Analiz
Home TR / EN
Security

How your data is protected

This page exists to keep the security claims measurable. We state what is encrypted and, just as plainly, what is not and why.

Last updated: 3 September 2026

01Where the boundary sits

The statement PDF you add in the app is not uploaded to a server to be analysed. Opening the PDF, extracting the transaction lines and sorting them into categories all happen on the phone's own processor.

Three things do reach the server, and all three are features you switch on yourself: signing in, cloud backup, and email document forwarding. Turn none of them on and your data stays on your device.

You can test this yourself: once the AI model is downloaded, switch on airplane mode and add a statement. If the analysis still runs, that document never left your phone.

02What is encrypted on the server

When you turn on cloud backup, your records are written to the server. There, the fields that identify you directly are encrypted at the application layer with AES-256:

FieldStatusWhy
Merchant nameAES-256 encryptedShows where you shop — the most identifying field.
Transaction descriptionAES-256 encryptedFree text; bank descriptions can carry personal detail.
Your notesAES-256 encryptedContent you wrote yourself.
Card last four digitsAES-256 encryptedA card fragment; the full number is never stored at all.
Card aliasAES-256 encryptedA name you chose, which may be personal.
AmountNot encryptedExport and totalling operate on this field.
DateNot encryptedPeriod ordering and filtering depend on it.
Category nameNot encryptedReport grouping uses this field.
The encryption key is managed server-side. This is not end-to-end (zero-knowledge) encryption: an administrator with server access could technically decrypt those fields. We say so plainly, because claiming otherwise would be false.

03In transit and in access

  • Encryption in transit: all communication between the app and the server runs over TLS.
  • Passwords: hashed with bcrypt; irreversible, and no plaintext password is stored.
  • Biometric lock: the app supports Face ID, Touch ID or fingerprint lock on the device.
  • Server access: restricted to authorised technical personnel over IP-restricted SSH.

04What we never ask for

None of the following is ever requested or stored:

  • Bank username or password
  • Open banking authorisation
  • Full card number or CVV
  • Card PIN

The app never connects to your bank's systems. The only input is the PDF your bank already issued to you.

05Email forwarding

If you turn on email document forwarding, the app gives you a dedicated address. A PDF you send to that address does reach our server, is parsed, and the raw file is deleted within 24 hours.

This is the exception to the “the PDF is not uploaded” statement at the top of this page, which is why it is written out separately. If you do not turn the feature on, no such transfer happens.

06The AI model

The models used for analysis are open source and are not bundled with the app; they are downloaded to your device on first use. The model does not query a server — it runs on the phone's own processor.

The model names and their licences are listed on the open source licences page.

07Reporting a vulnerability

If you believe you have found a security issue, write to destek@ekstreanaliz.com. Including the steps needed to reproduce it speeds up the review considerably.

We ask that you report it to us before disclosing it publicly, and allow a reasonable period for a fix.