Scope limitation
MyFinance is designed for read-only account analysis and budget management. Payment initiation is outside its scope. Limiting capability reduces both the authority requested from a bank and the consequences of misuse.
Bank authorisation
Planned integrations will use the bank's approved consent and authorisation process. MyFinance will not ask users to enter bank passwords, PINs or authentication codes into the application.
Integration target
The planned integration targets version 3.0 of the Payments NZ API Centre Open Banking standard. It will operate as a confidential client using the bank's supported OpenID Connect flow, private_key_jwt client authentication, PS512 signing and a registered public JWKS.
Development will use standards sandbox and synthetic data until live access is approved by the bank. Token and consent lifetimes will follow the bank's published limits.
Development controls
Security controls are being implemented and validated as the application is developed. The intended baseline includes:
- encrypted HTTPS connections for public and application traffic;
- least-privilege access to account information;
- separation of secrets from application source code;
- restricted administrative access;
- dependency and configuration review;
- minimised logging of sensitive application data;
- consent revocation and data-deletion paths; and
- documented incident handling before public availability.
Current assurance status
MyFinance does not currently claim ISO 27001, SOC 2 or other independent information-security certification. The product is not publicly available, and its controls will continue to evolve through development and bank testing.
Responsible disclosure
Security concerns can be reported confidentially to hello@myfinance.tools. Please include a clear description and steps to reproduce where appropriate. Good-faith reports will be acknowledged and investigated.