Your keys stay yours.
We treat your financial data the way we'd want our own treated — and we design the app so we never need access we don't actually require.
Read-only by default
We connect through read-only API keys and public wallet addresses. We can't move your funds, even if we wanted to.
Encrypted information
Financial records are sensitive even when access is read-only. Encryption in transit and at rest protects information without giving a connection control of your assets.
Source permissions
An exchange decides what an API key can access. Review those permissions at the source, and replace any key that has more access than your tax records need.
Minimum data we need
We only pull the transaction data needed to reconcile your activity — nothing more.
Report a concern
Describe the affected action and what you observed. Use test data, avoid other users’ records and never include credentials in a security report.
Review before sharing
A report can contain wallet addresses and transaction history. Check the recipient and the contents before sending a copy outside your account.
Watch for unexpected access
Unexpected sign-in messages or exchange activity need attention. Secure your sign-in details and revoke a potentially exposed API key at the exchange.
Keep your own evidence
Save source exports and final reports in a secure place. Account deletion does not remove downloaded copies or records on a public blockchain.
Before you connect an account
Create a separate key
Use a key for tax imports rather than reusing one from a trading tool. Enable only the read permissions needed for transaction history; leave trading and withdrawals disabled.
Check the source
Create the key on the exchange’s own website. For a wallet, provide a public address or an extended public key—not a private key or recovery phrase.
Review and revoke
Check the connected account and imported date range. If the key is exposed or no longer needed, revoke it at the exchange. Removing it from a message is not enough.
If something looks wrong
An unfamiliar balance or a missing import is not always a security incident. Check the source account first. Unexpected transactions or sign-ins require immediate action at the exchange or wallet provider.
- 1Revoke the affected API key at the exchange and secure your account credentials.
- 2Record the time, source and affected action. Do not copy secrets into screenshots or messages.
- 3Report the issue with a short description and redacted evidence. For wallet transactions you did not authorise, contact your wallet provider as well.
What account controls cannot erase
Public blockchain history
Transactions and addresses remain visible on the blockchain after you disconnect a wallet or close an account.
Shared and downloaded reports
Copies on your device or with an accountant remain outside account deletion. Store and share them as sensitive financial documents.
Required billing records
Personal account data is deleted within 30 days of account closure, except for information that must be retained by law.
Responsible disclosure
Found a potential vulnerability? Include the affected page or action, steps to reproduce and the potential impact. Use your own account and test data. Redact wallet credentials, personal records and session details from any evidence.
Do not access other users’ information, interrupt the service or continue testing after confirming a potential issue. A report does not authorise further access or imply a paid bounty. No system can guarantee complete protection against every risk.
Report a security concern