Is PocketSmith safe and legit? Company, security and data facts from official sources

Who runs PocketSmith and how long it has operated

PocketSmith says it was founded in 2008, and its about page names Jason Leong as CEO and co-founder and James Wigglesworth as CTO and co-founder. The same page lists a team of 31 people and a non-executive director, Lance Wiggs. [2] Its legal documents refer to PocketSmith Limited (PocketSmith Ltd), and the terms of service refer to New Zealand copyright and trademark law. [3] [8]

Independent press confirms the early history. The Otago Daily Times reported on 7 October 2008 that three co-founders, Jason Leong, James Wigglesworth and Francois Bondiguel, had been self-funding the software since 23 June after leaving Dunedin technology company e-Media. [6] A September 2009 PocketSmith press release on Scoop described it as a Dunedin-based web startup that won the Commerce Award at the 2009 TUANZ Innovation Awards. [7] Taken with the about page's 2008 founding date, that makes the company about 18 years old in 2026.

What is not published: the about page does not state current ownership, investors, a headquarters address or a customer count, and the privacy policy and terms give no street address. [2] [3] [8] If ownership matters to you, the New Zealand Companies Office register is the place to check, because nothing on PocketSmith's own pages answers it.

How bank connections work, by region

PocketSmith does not connect to banks itself; it uses third-party aggregators, and all feeds are read-only, meaning PocketSmith can retrieve transactions but cannot move money. [1] Which aggregator you deal with depends on where your bank is, and each one handles credentials differently, so it is worth knowing yours before you link.

Encryption, logins and payment cards

The security page says your connection is always encrypted with TLS and that transport security received an A+ rating from SSL Labs as of February 2024. Cloudflare sits in front of the service and terminates TLS and then makes a separate encrypted connection to PocketSmith's servers; PocketSmith states plainly that unencrypted content is available to Cloudflare during that step. [1]

Data is stored encrypted at rest, but individual database fields are not separately encrypted; PocketSmith explains that the application would need the key anyway, so a compromised application server could expose it. Passwords are hashed with bcrypt. [1]

Two-factor authentication with an authenticator app is available to every user, including the Free plan. Successful logins are logged and viewable under Settings, Security, and you can review and revoke third-party apps that have access to your account. Card details are not stored by PocketSmith; they go to the payment processor Windcave, which returns a token used for billing. [1]

Who inside PocketSmith can see your data

According to the security page, only a strict subset of employees can access customer data. Support staff may access your account to diagnose problems unless you object, and some engineering and operations staff have access as part of their roles. All employees are bound by confidentiality agreements. [1]

The privacy policy says PocketSmith will under no circumstances sell your personal information. It lists the parties data may be shared with: service providers and contractors under confidentiality, your bank feed provider, a purchaser or successor in a sale or merger, courts and government bodies when legally required, and other organisations for fraud protection and credit risk reduction. [3]

What PocketSmith does not publish

A fair safety review lists the gaps as well as the facts. The security page says explicitly that there is no formal bug bounty programme, and it does not mention penetration testing, third-party security audits or certifications such as SOC 2 or ISO 27001. It also does not state where data is hosted. [1] The privacy policy is marked as last revised on 12 February 2019 and the terms on 24 May 2018, so some wording may lag the product. [3] [8]

None of these gaps is evidence of a problem; they are questions you can put to PocketSmith support before linking accounts if they matter to you.

Leaving cleanly: deletion and retention

Account deletion is done in the web app: open the Profile menu, choose Subscription and Billing, click Delete your account, confirm, type DELETE and click Confirm. It cannot be done in the mobile app and the data cannot be retrieved afterwards. [4] Under the privacy policy, account and transaction data is permanently deleted from production databases, and encrypted backups kept offsite are retained for one year before being destroyed. [3]

Export first. Transactions can be downloaded as XLSX or CSV from the Transactions page, or as a CSV from Settings, User preferences, Export data. [5]

Checklist before you link a bank

Each item can be checked on PocketSmith's own pages or in your account in a few minutes.

• Turn on two-factor authentication with an authenticator app before adding any bank. [1]
• Find your region in the aggregator table and read that provider's own terms or data policy.
• Decide whether you object to support staff accessing your account for diagnosis, and tell support if so. [1]
• Check the login log under Settings, Security, and review the third-party apps with access to your account, revoking any you do not recognise. [1]
• Do a test export of your transactions so you know the exit route works. [5]
• If audits, hosting location or ownership matter to you, ask support in writing, since none is published. [1] [2]
• Note that deleted data lingers in backups for up to a year. [3]