Is Copreo safe?

Who accesses your accounts

Copreo does not connect to your bank itself. That is done by BANKSapi Technology GmbH in Munich, a payment service provider licensed and supervised by the German Federal Financial Supervisory Authority (BaFin). Copreo only uses BANKSapi to retrieve account data and never initiates payments. Copreo does not provide payment services itself.

When you connect an account, the app forwards you to an environment run by BANKSapi. There you enter your online banking credentials and approve access with your bank — usually through the bank's PSD2 interface with strong customer authentication, and for some banks through other access channels operated by BANKSapi. Your credentials are never passed on to Copreo or stored there.

The approval is limited in time and has to be renewed regularly; the app reminds you when it is due.

Read only, nothing moves

Copreo only reads account information: the app shows balances, transactions and portfolio holdings. You cannot make payments through Copreo.

Encryption and location

• All connections between the app, the server and third-party services use TLS.
• Account, transaction, portfolio and contract data is additionally encrypted with AES-256-GCM in the database, never stored in plain text.
• Passwords and app PINs are stored only as cryptographic hashes.
• Servers and database are run by Netcup GmbH in data centres in Germany. BANKSapi also runs its systems in Germany (noris network AG, Nuremberg).
• In the app you can also set a passcode and biometric unlock.

Which services run outside Germany

A few add-on services run through providers in the US. The Privacy Policy lists them in section 7:

• Merchant categorisation (Anthropic): only with your consent and only public merchant names or domains — no names, IBANs or payment references.
• Push notifications (Expo): push token and message content, which can include amounts or merchant names. If push notifications are off, nothing is sent.
• Sign in with Apple or Google, and the verification of subscription purchases with the App Store and Google Play.

No ads, no tracking

Copreo uses no advertising or tracking SDKs and shows no ads. The automatic analysis of your transactions, merchant categorisation and taking part in shared categorisation each run only with separate consent, which you can withdraw individually in the app.

Deleting your account

You can request deletion at any time in the app or with the form at Delete account. The request locks access, and the approvals at BANKSapi are revoked immediately. After seven days, the account, bank data and transaction data are deleted for good; until then you can cancel the deletion. If you explicitly ask for it, deletion can happen straight away.