1. No bank connections, ever
Last Wallet does not use bank-linking services (such as Plaid or open-banking APIs), does not ask for your online banking credentials, and has no feature, planned or otherwise, to connect directly to a bank, card issuer, or payment provider. It cannot see your real account balances, cannot read your bank statements automatically, and cannot authorize, initiate, or reverse a transaction anywhere. Every balance you see in the app is simply the sum of the entries you or your integrations have created.
This is a deliberate design choice, not a current limitation: Last Wallet is a ledger, not a payment or banking product, and it is not intended to ever be linked to a bank account. That keeps your real money outside the app’s reach entirely — the worst-case impact of a bug or a compromised account is incorrect records, never an unauthorized transfer, because there is no channel through which the app could move funds.
2. What can create an entry
Every transaction in Last Wallet is created one of three ways, and all three are under your control:
- You enter it. Manually, in the app, on web or mobile.
- You import it. From a CSV/XLS file you choose to upload — nothing is fetched automatically from any external account.
- You automate it. Through a developer API key you generate and a third-party tool you choose to connect (such as Make.com, n8n, Zapier, or Apple Shortcuts), or by forwarding a bank SMS or email yourself for AI-assisted parsing. By default, entries created this way land in a review queue and have zero effect on your balances until you personally approve each one — you can mark a specific API key as trusted to skip that step, but that is an opt-in choice you make per key, not a default behavior.
There is no background process that reaches out to a bank on your behalf. If nothing is entered, imported, or approved, nothing changes.
3. Account security
- Passwords are never stored in plain text — only a securely hashed credential is kept, using industry-standard hashing.
- Sessions are authenticated on every request; the web app uses a secure session cookie and the mobile app uses a bearer token, both validated server-side before any data is returned.
- Every API request is scoped to your account. Your accounts, transactions, and reports are never visible to other users, and every client-supplied reference is checked against your ownership before it’s used.
4. Data protection
- Data is encrypted in transit (TLS) between your device and our servers.
- Data is encrypted at rest in our managed database.
- Regular, automatic backups mean a lost phone or a fresh install never means losing your financial history.
- Access to production systems is restricted to what is needed to operate the service.
5. Developer API keys
API keys are entirely optional and only exist if you create one. They can read your accounts and categories and post draft or approved transactions — they cannot touch billing, cannot change your password, and cannot, like everything else in the app, reach an external bank account. Keys are scoped and revocable at any time from Settings, and default to review mode so nothing an integration sends affects your balances until you say so.
6. Your data, your control
You can export your data to CSV at any time, and you can request deletion of your account and its data whenever you want — see our Privacy Policy for the details. We do not sell your data and do not use it to serve ads.
7. Reporting a security issue
If you believe you’ve found a security vulnerability in Last Wallet, please report it responsibly to security@lastwallet.app rather than testing it against other users’ accounts or disclosing it publicly. We will investigate and respond as quickly as we can.
8. Questions
For anything else about how Last Wallet keeps your data safe, see our Privacy Policy and Terms & Conditions, or email us at security@lastwallet.app.