Security and your data
People trust us with something personal. Here's how we look after it, in plain English.
You stay in control of your bank connection
Employees connect their bank only with their explicit consent, through a secure, authorised open banking connection. Access is read-only: PrizeBnk can't move money, and savings always stay in the employee's own bank account. Each consent lasts 90 days. Seven days before it expires, employees get a notification, an email and an in-app prompt, and they decide whether to renew. They can disconnect at any time.
Bank data is never sold or used for marketing
We use bank data only for the purposes explained when people join: savings goals and insights, the daily spending review, draw entries, and anonymised, aggregated reporting to employers.
Employers see the big picture, not personal finances
Employer reporting is anonymised and aggregated. Employers never see individual balances or transactions, and the leaderboard shows nicknames rather than real names.
Independently tested
In October 2026, a specialist security firm carried out an independent penetration test of our platform and APIs. The findings have been fixed, and the testers confirmed the fixes.
Protection built in
- Multi-factor authentication on all admin accounts
- Rate limiting to protect our systems from abuse
- Security headers, and sensitive data redacted from our logs
- Encryption in transit (HTTPS/TLS) and at rest
- Employee data stored in the UK (Google Cloud, London region)
Delete your account at any time
Employees can delete their account and personal data from inside the app.
Your rights and questions
You can ask to access, correct or erase your data by emailing sanil@prizebnk.com. We respond within one month. For complaints, email complaints@prizebnk.com.
Privacy Policy