Security and privacy

How Forward protects your money data.

Plain answers to what we can see, what we store, and what happens if something goes wrong. Last reviewed October 2026.

Passkeys and multi-factor sign-in

Sign in with a passkey, using Face ID, Touch ID or your device PIN, so there is no password to steal or reuse. A passkey counts as two-step sign-in on its own, or you can add an authenticator app. Two-step sign-in is required before you link a bank.

Forward's sign-in screen, with Sign in with a passkey and Continue with Google above the email and password fields
The Sign-in & security screen, listing a saved passkey, with an authenticator app and passkey sign-in as the two ways to turn on two-step verification

Your bank password never touches Forward

Members

Bank connections go through Plaid, so you sign in to your bank on Plaid's screen, never ours. The access token Plaid gives us is protected with a second layer of encryption using Google Cloud's key management service. See Plaid's End User Privacy Policy for how Plaid handles your data.

Locked to your household

Every request is scoped to your household, and the database enforces that on its own with row-level security. A bug in the app can't show your budget to another household.

Our team needs your permission

Our team can't open your budget unless someone in your household shares it with support, using Share with support on the Household screen. That access ends after 14 days, or sooner if you end it. The one exception is fixing an outage that affects everyone, and every use of it is logged.

The Household screen's Share with support card: support can read transactions and budget, sharing ends on its own after 14 days, and a Stop sharing button ends it sooner

AI assistants on your terms

Members

When you connect an assistant, you choose which budgets it can use, and every connected assistant is listed in Connected apps. Once it has your data, its maker's terms and privacy policy apply, so connect only assistants you trust. Disconnect any time from Connected apps. How to connect an assistant.

The Connected apps screen, showing Claude with the budgets it can use, when it was connected, and a Disconnect button

Receipts and email

Members

Uploaded receipts are scanned for viruses, then read with Google Cloud to find the store, date and items. Email receipts work by forwarding, so Forward never asks for your inbox password or access to your Gmail.

A Kroger receipt linked to its $15.96 charge, with each item and the total read from the receipt

Nothing is erased

Your budget is an append-only ledger: every change is a new entry, and undo adds another. Closed months keep their numbers unless you reopen one.

Backed up and tested

Daily backups and point-in-time recovery, with a full restore drilled in September 2026. Every change runs 10,000+ automated tests.

We never sell your data

Your budget pays for nothing but itself. No ads, no data sales.

Report a concern

Found a security issue? Email security@forwardbudget.app.