Your data, your rules
Treziqo takes the privacy and security of your financial data seriously. We don't sell your data to advertising partners and don't use it for marketing profiling. We transparently show what data we store, where it's stored, and how it's protected.
EU hosting (Hetzner DE)
Server runs in Hetzner datacenter in Germany — under EU jurisdiction and GDPR. No US Cloud Act, no foreign subpoenas. Your data never leaves European legal protection.
Specifically: Hetzner Online GmbH, Falkenstein/Vogtland, ISO 27001 certified.
HTTPS / TLS transport
All browser-to-server traffic uses HTTPS with TLS 1.2 and TLS 1.3 (Let's Encrypt cert, auto-renew). Legacy and insecure protocols (SSL, TLS 1.0/1.1) are disabled. The server sends an HSTS header valid for 1 year — your browser remembers it and will only ever connect to Treziqo over HTTPS, even if someone tries an HTTP downgrade.
HTTPS configuration rated A+ in the public Qualys SSL Labs assessment (see panel below).
Hashed passwords + 2FA
Passwords are never stored in plaintext — bcrypt hashing on every registration (slow-by-design, mitigates offline brute-force at scale). You can enable two-factor authentication (TOTP) in /settings — compatible with Google Authenticator, Authy, 1Password.
On password change, sessions on other devices are invalidated (AuthenticateSession middleware) — eventual force-logout after a leak.
Sensitive data encryption
Sensitive server configuration (e.g. SMTP password for mail relay) is AES-256 field-level encrypted in the DB via APP_KEY. Transaction notes encryption is opt-in in /settings → Security — once enabled, no one with DB dump read access can read them. Trade-off: it disables full-text search in note text (amount, date, category and account stay searchable).
Note encryption is optional — default after sign-up is off, so full-text search works. Enabling it (anytime) trades note text search for protection against DB leaks.
Daily backups
Database is backed up daily via Laravel Forge — snapshot to isolated storage for fast recovery after hardware failure, mistake, or migration. We retain the last 14 days of backups.
Backups never leave the EU; only the project author has access.
Regular security audits
CI workflow runs on every push to main — gitleaks scans for accidental API keys committed to git, composer audit + npm audit for CVEs in dependencies, Larastan level 5 static analysis, Pest test suite (340+ tests). Dependabot opens PRs weekly for outdated packages.
Goal: no incident should be caught only after a production deploy.
No tracking, no ads
No Google Analytics. No Facebook Pixel. No third-party cookies. Your expenses are never seen by Meta or any ad-tech. The cookies banner only shows technically essential cookies — no „accept all" theatre.
Verify yourself: open DevTools → Network → you'll only see treziqo.com and paypal.com (subscribe flow).
Your data, your export, your deletion
Anytime in /settings you download a ZIP with everything we have on you — JSON files with accounts, transactions, categories, budgets, payments. Same anytime you delete your account in one click (with confirmation) and everything is gone. No „give us 30 days notice", no retention on our side.
No part of our business depends on holding data against your will — Treziqo is paid by subscription, not by lock-in.
Responsible disclosure
Found a security issue? Email security@treziqo.com with details and reproduction steps. I promise a response within 72 hours and a fair approach — no legal threats over good-faith disclosure. We publish known incidents.
Goal is cooperative networks, not an adversarial relationship with researchers.
HTTPS / TLS rated A+ by SSL Labs
Treziqo has achieved an A+ rating in the public Qualys SSL Labs HTTPS/TLS assessment. Our configuration supports modern TLS 1.2 and TLS 1.3, disables legacy SSL/TLS 1.0/1.1, and enforces HTTP Strict Transport Security (HSTS) with a long duration.
Check current result on SSL LabsReal-time uptime monitoring
Treziqo is publicly monitored via UptimeRobot — independent pings from multiple locations every 5 minutes. If the app stops responding, we get alerted within minutes. You can check the live status page anytime yourself.
Live uptime statusQuestions, concerns, suggestions?
If something is missing from our transparency, let us know. Treziqo is a tiny company — the project author replies directly. No 5-tier ticketing system.
security@treziqo.com