Security

How your bills are protected

Written for people, not for security engineers. If you want the deeper technical detail, email us and we will send it.

What the lock actually is

Shugo uses AES-256 encryption. The important part is not the algorithm, it is who holds the key. In most apps, the company does. In Shugo, the key is created on your device the first time you sign in, and it stays there.

When your bills leave your device — to sync to your phone, or to back up — they are already locked. We are storing a sealed box. We do not have a copy of the key, so there is no button anywhere at Shugo that opens it.

How you unlock it

• Your passkey, day to day. Face, fingerprint, or device PIN. One tap, and the key unlocks on your device. Nothing about your face or fingerprint is ever sent to us — that check happens entirely on your own hardware.
• Your recovery code, when you are on a new device. A long random code Shugo gives you once, at setup. It is the only way into your data from a device that has never been set up before. Keep it somewhere safe and offline.

If a device is lost or stolen

From Settings on any device you still have, you can remove a lost device so its passkey no longer opens your data, and you can generate a fresh recovery code, which immediately retires the old one. If you think someone got in, there is a stronger option that re-locks everything with a brand-new key — anything an attacker copied earlier becomes useless.

Bank connections

Connecting your bank is optional, and off until you turn it on. When you do, it finds your recurring payments for you and works through Plaid — meaning you enter your bank credentials with Plaid, never with Shugo, and the bills it finds are encrypted on your device like everything else.

The one place your data is not sealed with your key. Plaid's API can only be called with a secret, and a secret cannot live safely in a browser — so your transactions and balances travel from Plaid through our server on the way to your device. We pass them straight through: nothing is written to a database, a file, or a log, and we hold no copy afterwards. Your browser seals them with your key the moment they arrive.

What that means if our servers and storage were ever broken into: the risk is forward-looking, not backward-looking. An attacker inside our systems could see bank data belonging to people who happened to be syncing during the break-in. They could not read your history — there is no stored bank credential to take, no archive of your transactions, and no key that would open the sealed copies we hold.

One case sits outside that promise, and naming it matters more than sounding safe. Shugo is code we send to your browser, and that code is what does the sealing. An attacker who gained the ability to change the app itself — a different and more serious break-in than reading our storage — could ship tampered code that captures keys as people unlock, and a stolen key opens that person's sealed file, history included. Every app that encrypts on your device shares this limit. That is the real shape of it, and we would rather you knew it than be told something rounder.

Whether or not you connect a bank, Shugo never asks for your bank username, password, card number, or account and routing numbers, and we never keep a readable database of your transactions.

Sessions and auto-lock

Shugo locks itself after a period of inactivity, and you can lock it yourself at any time from Settings. Locking clears the unlocked key from your browser, so walking away from a shared computer does not leave your bills readable.

What the lock can't do

• Losing every way in at once. Individually, these are all recoverable — a lost code is replaced from a signed-in device, a lost device is removed from another one. But with no code and no signed-in device left, nobody can open your data, including us. Keep a backup and you never reach this point.
• A compromised device. If malware is running on your unlocked phone or laptop, it can see what you can see. No app can fix that from the outside.
• Your Google account being taken over. Sign-in runs through Google, so protect that account — turn on two-step verification.

Certifications, stated honestly

Shugo is a young product. We do not hold a SOC 2 or ISO 27001 certification yet, and we are not going to imply otherwise with a badge. What we can tell you is exactly how the system works, which is what this page is for.

Found a security problem?

Please tell us at security@shugo.online. We will confirm we received it the same or next business day, and we will not take legal action against anyone who reports a problem to us in good faith and gives us a reasonable chance to fix it before going public.

See also our privacy policy, which covers what we collect and what we do not.