Built to hold your money data carefully.

• Every account gets its own isolated database. There is no query in the app that can reach another account's data.
• We never ask for your bank login. You hand us a PDF or OFX export; nothing connects to your bank — unless you opt in to SimpleFIN sync, a read-only bridge you pay and control, where your login still never touches Pare.
• Uploaded PDFs are deleted the moment they're parsed.
• Everything is encrypted in transit (TLS) and at rest.
• No analytics, no ad trackers, no data selling.
• You can hard-delete your account and everything in it, yourself, at any time.
• The whole app is open source — you can read exactly what it does, and self-host it if you'd rather trust no one.

Your financial data doesn't sit in a shared table behind an account_id filter — the usual place multi-tenant apps spring a leak. Instead, each account gets its own database (a Cloudflare Durable Object with a private SQLite store).

The database is addressed by your account ID, so every request is routed to your store and only yours. There is no code path that can query across accounts — the boundary is enforced by construction, not by a WHEREclause someone could forget. We keep automated tests that prove two accounts can't see each other's data.

The hosted service has no link to your financial institution. There's no “connect your bank” step, no stored bank credentials, and no third-party aggregator (Plaid and the like) sitting between you and your accounts. You export a statement PDF and upload it. That's the whole pipeline — which means there's no standing connection for anyone to abuse.

Pare offers one explicit exception: an opt-in SimpleFIN sync (available self-hosted, and on hosted plans that include it). It's read-only, you pay and control the bridge directly, and your bank credentials live there — Pare stores only a revocable access token, kept out of your data exports and backups. Off by default, and on self-host a PARE_SIMPLEFIN_DISABLED flag hides it entirely.

An uploaded PDF lives in object storage (Cloudflare R2) only long enough to be parsed into transactions, then it's deleted. We don't keep a copy of your original statements. The parsed numbers — transactions, balances, the categories and goals you create — are what stays, in your isolated database, until you remove them.

In transit: every connection is TLS-encrypted, end to end.

At rest:your data is encrypted on disk by Cloudflare, our infrastructure provider. To be precise about what that means: the encryption keys are managed by the platform, not derived from your password — so this protects against a stolen disk or storage dump, not against Pare's own running server (see Straight talkbelow). We don't overstate this.

Passwords are never stored in readable form — only as a salted hash. Sign-in supports passkeys (WebAuthn), so you can skip passwords entirely and use your device's biometrics. Sessions are carried in a hardened, HTTP-only cookie.

Sign-in, sign-up, and password-reset endpoints are rate-limited to blunt brute-force and abuse, and sensitive forms run a bot check.

There are no analytics SDKs, advertising identifiers, or third-party trackers in Pare. We keep basic operational logs to run the service and fix bugs, and our error reporting is scrubbed of personal data before anything is recorded — email addresses, auth tokens, cookies, and request bodies are stripped out.

From your profile you can permanently delete your account. It's a real, hard delete: your entire per-account database is dropped, any stored PDFs are purged, and your sign-in identity is removed. No soft-delete, no tombstone, no recovery. You can also export everything (CSV/JSON) first, or wipe transactions while keeping your account.

Pare's source is public on GitHub. You don't have to take any of the above on faith — you can read the code that handles your data. And if you'd rather not trust a hosted service at all, you can run Pare entirely on your own machine, where your data never leaves your computer.

Security pages love absolutes. Here's where we won't use them, because they'd be untrue:

• Pare is not zero-knowledge.To parse your statements and build your dashboards, the server works with your data in the clear, in memory, during that processing. At-rest encryption uses platform-managed keys, so a claim like “we can never see your data” would be false. We'd rather say it plainly.
• We don't guarantee a storage region. Data runs on Cloudflare's global network; we don't pin it to a specific country today.
• No SOC 2 report yet.Pare is early. The controls above are real and you can verify them in the source, but we haven't gone through a formal third-party audit. If you need one for a business use, tell us — that's exactly the kind of demand that decides when we pursue it.

The honest version: strong isolation, no data selling, ephemeral statements, and open code you can inspect — and full control if you self-host.

Found a security issue? Please email security@pare.money with the details and how to reproduce it. We'll acknowledge it, keep you posted on the fix, and credit you if you'd like. Please don't test against other people's accounts or data — self-host an instance to probe instead.