Security

We take security very seriously, and we support you in being cautious about how your financial data is being handled. But you don’t just have to take our word for it. This page explains how your data and privacy are protected, and how you can verify this for yourself.

Smoothy uses the official open banking system regulated by the New Zealand government. Using open banking to share your bank data with other apps is very secure — banks would not let customers connect their bank accounts to other apps if it wasn’t. Data shared via the open banking system is encrypted in the same way as the data you see in your mobile banking app.

We use Akahu, New Zealand’s most widely used open finance provider to facilitate bank feeds and account connections. For ASB, ANZ, BNZ, Kiwibank and Westpac, Akahu connects to banks via your mobile banking app, which does not require you to provide any bank login details.

Akahu also supports ‘classic’ connections for banks such as TSB and other financial services that are not yet integrated with the regulated open banking system. Classic connections are facilitated by Akahu logging in as you to fetch data if you authorise it.

For all connection types, data is encrypted while being transported and while not being viewed by you, and neither Smoothy nor Akahu store any bank or financial service provider login details.
Read more at akahu.nz/safety and Akahu’s privacy policy.

You can disconnect your bank feeds at any time in Smoothy, in your bank’s app, or at my.akahu.nz. When you disconnect your bank accounts or delete your Smoothy account, we no longer have access to your bank feeds and we automatically delete any bank data that we hold. Read our privacy policy for more details.

We do not sell your information, and we never share your bank data with advertising, marketing or analytics platforms. We do not use your data for AI training. See our privacy policy for the full list of who we share information with.

Data encryption

Data is encrypted while being transported and while not being viewed by you.

Every connection to Smoothy uses HTTPS. All traffic to and from our app is protected with modern TLS encryption and a certificate issued by a publicly trusted certificate authority. In plain terms: the connection between your device and us is private, and your browser has independently confirmed our identity before any data is exchanged. Nothing we use is self-signed or untrusted.

What our certificate confirms

• Encrypted with modern TLS (currently TLS 1.3).
• Certificate issued by a publicly trusted authority (currently Google Trust Services).
• Complete, valid certificate chain that verifies without errors.
• Logged in public Certificate Transparency records, which browsers now require.

Your data is also encrypted at rest. Our database and its backups are encrypted with AES-256.

How to check our security status

There are a number of independent services, not run by us, that you can use to verify the security of the Smoothy app. These services inspect our live security certificate and report what they find, so you can confirm everything first-hand. Certificates are renewed regularly, so these links always show the current, up-to-date result.

• SSL Labs report — full grade, issuing authority and chain check for app.smoothyhq.com.
• SSL Labs (sign-in host) — the same independent check for our sign-in service.
• Certificate Transparency log — public, tamper-evident record of every certificate issued for our domain.
• Hardenize report — a broader overview of our encryption and email security posture.

Using a firewall or network filter?

Some network security tools can block our sign-in even though our certificate is completely valid. This happens because the tool filters by web address, not because anything is wrong with our security.

If sign-in will not load, you can allowlist (whitelist) the Smoothy app domains in your firewall settings, or exclude them from TLS inspection:

*.smoothyhq.com   clerk.app.smoothyhq.com   *.akahu.nz

If you have any issues or questions, contact support@smoothy.nz.

Report a security issue

If you believe you have found a security problem, we would like to hear from you. Please email support@smoothy.nz.