Built to keep your money private.

The safest data is data we never have. So Kosh is built to need as little as possible.

• In transit: every connection to Kosh uses TLS (HTTPS).
• At rest: your database records and statement files are encrypted with AES-256 by our storage and database provider.

• Statement files live in a private storage bucket in Tokyo, Japan. Browsers can't read from it, and it has no public links.
• Uploads use one-time signed URLs that work for a single file, for a short time.
• Only our server can read files back, using a key that never reaches any browser.
• The database has row-level security on every table, with no access for public roles. Your data can only be reached through our server, which checks it's you.

• Passwords are stored as salted PBKDF2-SHA256 hashes with 100,000 iterations. We never store or see the password itself.
• Sign-in sessions are long random tokens. We store only a SHA-256 hash of each one, so a copy of our database couldn't be used to sign in as you.
• The session cookie is HttpOnly, Secure and SameSite=Lax, and expires after 30 days.
• Sign-up, sign-in and newsletter forms are rate limited to stop password guessing and abuse.
• Every request that changes data is checked to make sure it came from Kosh itself, blocking cross-site request forgery.

To read a statement or answer a question, Kosh sends the relevant data to our AI provider, DeepSeek, over an encrypted connection. We send only what each task needs. A question about your budget, for example, gets a summary rather than every statement you've uploaded. The Privacy policy explains where this processing happens.

• Delete any statement, and the file behind it, from the Statements page at any time.
• Download a copy of everything with Settings → Download my data.
• Delete your account with Settings → Delete my account. We erase your data, including statement files, within 30 days.

• Use a strong password that you don't use anywhere else.
• Sign out on shared devices.
• Be wary of anyone claiming to be Kosh who asks for an OTP, PIN, password or payment. We will never ask for these.
• Write to contact@trykosh.com straight away if you notice anything strange in your account.

No system is perfectly secure. If a personal data breach affects you, we'll tell you and the Data Protection Board of India as the Digital Personal Data Protection Act, 2023 requires, and report to CERT-In where the law requires it. We'll explain what happened, what it means for you and what we're doing about it.

If you think you've found a security issue in Kosh, we want to hear from you. Thank you for helping keep our users safe.

Email

contact@trykosh.com

Subject line

Security

Our response

Acknowledged within 48 hours

Please include steps to reproduce the issue and its likely impact. While you investigate:

• don't access, change or delete other people's data. Use only your own test account;
• don't degrade the service, for example through denial-of-service tests, spam or heavy automated scanning;
• give us reasonable time to fix the issue before you share it publicly.

If you follow these rules and act in good faith, we won't pursue legal action against you for your research.