Security

Last updated: October 30, 2026

Kilter holds some of the most personal data there is: your accounts, your spending and your plans. This page says how we protect it and what you control. Our privacy policy lists everything we collect and who helps us handle it.

In short: Kilter can't move your money. Your bank password goes to Plaid, never to us. We don't sell your data or show ads. You can export your data or delete your account whenever you like.

Your bank connections

• You sign in to your bank through Plaid, so Kilter never sees your bank password.
• Kilter can read your balances, transactions and investments. It can't move money, make payments or trade.
• Kilter gets only the last few digits of each account number, to tell your accounts apart.
• The access Plaid gives Kilter is encrypted with AES-256 and its own key, and that key is locked with one that never leaves Google Cloud's key service. Only the running app can use it, so even a full copy of the database wouldn't open your bank connections. Google makes a new version of that key every 90 days.
• You can disconnect a bank any time on the Connections page. Syncing stops right away, and Kilter's access through Plaid is removed, usually within seconds.

Files you import

• When you import a file from your bank or another money app, Kilter reads it and saves what's in it. It doesn't keep the file.
• Account and card numbers in a file are masked. Kilter keeps only a one-way code, so it can recognize the account next time but can't turn the code back into the number.
• A spreadsheet you bring in is read by Anthropic's Claude, which finds your accounts and their history for you to check before anything is saved. Anthropic can't train its models on it.
• Each import shows on the History page, with what it added.

Signing in

• You sign in with Google, Apple, a code we email you or a passkey, so Kilter has no passwords to steal. For a passkey, Kilter keeps only its public key. Your fingerprint, face or PIN stays on your device.
• Deleting your account or adding another way to sign in needs a sign-in from the last 15 minutes, so someone who finds your session open can't do either.

Where your data is kept

• Your data is stored with Google Cloud in the United States. It's encrypted in transit, and at rest with AES-256.
• Only Kilter's founder can reach the systems that hold it, and each of those accounts needs two-step sign-in.
• Google logs every read of Kilter's secrets, every use of its encryption key and every connection to its database.
• The AI tools that help build Kilter can't reach your data. Google Cloud blocks them from the database, the secrets and the encryption keys.
• Kilter's admin pages show account facts, such as your email and subscription, never your accounts, transactions or plans. The one exception is a conversation you choose to send with a thumbs down on an answer, and it's shown without your name.
• Our product analytics never see your financial data: no amounts, merchants, account names or plans. Only what you write in a feedback message reaches them.
• The database is backed up every day, and each backup is kept for 14 days.

AI

• Kilter uses Anthropic's Claude for the assistant and to categorize transactions from merchants it hasn't seen before.
• To categorize, Kilter sends a transaction's description and amount, not who you are. Payments to or from people, such as Interac e-Transfers or Zelle, are never sent to be categorized.
• The assistant sees your messages and the parts of your data it needs to answer.
• Anthropic can't train its models on your data. It deletes what Kilter sends within 30 days, unless its automated systems flag it as breaking Anthropic's usage policy or the law requires keeping it longer.
• The assistant keeps short notes about you. You can read, edit or delete them in Settings → Assistant & apps.
• Your own AI app (Claude, ChatGPT or Codex) reaches your data only if you connect it. Each change it makes shows on the History page under its name, and you can undo it there. You can disconnect it any time in Settings → Assistant & apps.

What you control

• The History page shows every change to your data, with its before and after, whether you, your partner or an AI app made it. You can undo changes there.
• In Settings → Data & privacy, you can download everything we hold about you, with your transactions as a spreadsheet.
• You can delete your account there too. Your data is erased from our database at once, and backup copies expire within 14 days.
• We don't sell your data, show ads or use advertising trackers.

What's still to come

Kilter is new, made by Loam Labs Inc., a small company in Squamish, BC. It hasn't had an outside security audit or penetration test yet, and this page will say when it does. Kilter's code and the software it uses are checked for known vulnerabilities every week, and critical ones are fixed within 7 days.

Reporting a problem

If you think you've found a security problem in Kilter, email security@trykilter.com. We'll reply within 3 business days. If a breach puts your information at risk, we'll tell you and the authorities as the law requires.

Loam Labs Inc., Squamish, BC, Canada · security@trykilter.com