Your data, under your control. And only you can get in.
Follow your data from your bank's consent screen to the day it's deleted. Each step shows the screen or email you'll see.
Last reviewed 27 September 2026
- You choose the accounts to share, on your bank's own screen.
- Your data is stored in Australia (Sydney).
- Every account needs a second factor.
- You can stop sharing any time, and we delete that bank's data.
- We never sell your data.
What happens to your data when you connect a bank?
You approve sharing at your bank. The data is stored in Sydney, we look at it only to fix a problem you report, keep Busybee running and secure, or meet a legal obligation, and it's deleted when you stop sharing or leave.
You connect on your bank's own screen.
You choose the accounts to share and approve sharing on your bank's own consent screen. Busybee never sees your banking password.
- Access
- View only
- Data
- Balances, transactions, direct debits
- Until
- 17 Sep 2027
Stored in Sydney, encrypted.
Your data is stored in Sydney and encrypted in the database. Our logs never contain your transactions, amounts or merchant names.
Technical detail
The database runs in Sydney and is encrypted at rest. The identifiers that link your account to your bank connection are sealed again with AES-256-GCM and bound to your account, so a copied value can't be opened anywhere else. Requests are handled on Cloudflare's network, which processes them in memory.
Only you get in.
Every account has a password plus a passkey or authenticator app. When someone signs in from a browser we haven't seen, you get an email with a link that ends every session at once.
Technical detail
Passwords are 12 to 128 characters and are checked against passwords known to have leaked. A sign-in needs a password plus a passkey, authenticator code or backup code, or a passkey on its own. A browser you choose to trust skips the second factor for 30 days.
Your account was just signed in to from a device we haven't seen before.
- Device
- Firefox on Windows
- Approximate location
- Melbourne, VIC
- Time
- 24 Sep 2026, 9:41 pm AEST
If this was you, there's nothing to do.
Not you? End every session now. Anyone signed in is signed out, and your password stops working until you set a new one.
End all sessionsThis link works once and expires in 7 days.
You can see everything we hold.
Settings, Your data shows each bank's consent record, when each sync collected data, and an activity log of changes to your consents and data.
Leave any time.
Stop sharing one bank, or delete your account. We end the sharing with your bank first and then delete the data. You can download everything before you go.
Accounts left with no bank connected for 12 months are deleted, with a warning a month before.
- Expires
- 17 Sep 2027
- Last synced
- 2 hours ago
- Given
- 17 Sep 2026
We stop collecting from CommBank, end the consent at your bank, and delete 461 transactions collected through this consent, 3 accounts and the recurring series, category changes and merchant names built from them that no other bank still uses. This can't be undone. This record stays so you can see what was collected.
What do Busybee emails contain?
Only what you need to act on. Never your money or your name, so an email that's forwarded or read over your shoulder gives nothing away.
- One-time codes
- Bank names
- Dates
- Device descriptions
- Approximate location
- Amounts
- Merchants
- Account numbers
- Your name
How do I report a security issue?
Email us with what you found and how to reproduce it. support@busybee.money
Please don't include anyone else's personal or financial data in your report.
Be ready when Busybee opens.
Email support@busybee.money to join.