Security
The safest record is the one nobody is holding.
What we do not hold
No bank linking, and no plans for it.
Ahead never asks for your net-banking login, and never asks you to let anything read your account. Transactions are typed in. That is slower, and it is why people who do it notice where their money went, but the security argument is separate and simpler: an app holding thousands of bank logins is a target, and its worst day is also its customers’ worst day.
What is stored is what you typed: amounts, dates, payee names, categories and notes. Enough to be private, and worth protecting. Not enough to move money with.
The business case for reading people’s bank accounts is strong. The case against is that it is somebody’s bank account.
Your account
Two-factor, and a way back in.
- Any authenticator app
- The one you already use works. Turning two-factor on asks you to type a code back from the app first, so it can never end up switched on in a way that locks you out.
- Recovery codes
- Generated when two-factor is turned on, and regenerable. Two-factor without a recovery route is not a security feature, it is a way to be locked out of your own records by a dropped phone.
- Your sign-in cannot be lifted
- It is held where scripts on the page cannot read it, so even a malicious script that somehow ran there would have nothing to take.
- Sign-in keeps its members private
- A wrong password and an email with no account get exactly the same answer, so nobody can use the form to find out who uses Ahead. Repeated attempts are slowed down for each email and each connection.
- A password reset by email
- With a link that expires. It shipped alongside two-factor on purpose, so a lost phone is never the only thing standing between you and your own records.
Other people's money
No other household can reach your records.
Every record belongs to a household, and every lookup is limited to yours before any other code runs. It is not a check somebody has to remember to add to each screen: it is attached to the question the database is asked, so a screen built next year gets it without anyone thinking about it. The one exception is a share link, which can find exactly one loan and nothing else.
The numbers in an address are random rather than a count. A link cannot be edited into somebody else’s record, and nobody can count our customers by watching the numbers go up.
What you send out
A share link shows only what it was built to show.
The page behind a share link is built from a short, written list of what may appear on it. Your account names, category names, other transactions and private note on the loan are not on that list and cannot join it by accident. Built the other way, by hiding things from the full statement, anything added to the app later would appear on it by default.
A link can carry a password, which is never stored or logged as you typed it, and an expiry, both changeable afterwards. Revoking a link deletes its password too: there is no reason to keep a password for a link that no longer exists.
Getting out
Both exits work when it would pay us if they did not.
Export and delete are the two things a subscription is never allowed to block. Not while a payment has failed, not while the household is locked, not while it is cancelled. That is the whole point of writing it down: a promise that only holds while it is convenient is not one.
A note on what this page is not
Ahead is a small product built by a small team, and this page describes design decisions rather than an audit, a certification or a bug bounty. What is here is what is true. If you find something wrong with it, say so and it will be fixed and written down.
Take the export on day one, if you like.
Everything the household has, as a zip of CSVs. It works before you have paid anything.
- No card
- Nothing starts charging when the trial ends.
- Nothing to connect
- No bank login, and nothing reads your SMS.
- Export whenever
- A zip of CSVs, paid or not.