All guidesUser guide

Security & App Lock

Two layers protect your data: App Lock keeps your financial workspace hidden behind your device security every time you reopen the app, and a two-factor authenticator gates the most sensitive action — connecting a bank.

App Lock — verify it’s you on every reopen

Once you’re signed in, Sumwright no longer asks for your password each time. Instead, the app locks itself the moment you switch away or close it, and asks you to verify it’s you before your accounts, balances, and bills are shown again. Unlocking is never automatic — you choose your method each time.

iPhone & Android
Tap Unlock and confirm with Face ID, Touch ID, or your fingerprint. If biometrics fail or aren’t set up, you can fall back to your device passcode.
Windows
Click Unlock with Windows Hello and confirm with your face, fingerprint, or PIN — or enter your account password instead.
Mac
Enter your account password to unlock.
Web
The website is your account and storefront, not the financial workspace, so it isn’t locked. On a shared computer, use Sign out when you’re done.
Nothing extra to set up. App Lock uses your device’s own security. As long as your phone or computer has Face ID, a fingerprint reader, Windows Hello, or a passcode/PIN enabled, App Lock is on automatically — there’s no separate switch to flip.
If you can’t unlock: Make sure your device’s biometrics or passcode are set up in your device settings. On Windows or Mac you can always fall back to your Sumwright account password.

Two-factor authenticator (required to link a bank)

Before you can connect a bank, Sumwright asks you to enroll a time-based one-time-passcode (TOTP) authenticator. This is the same six-digit-code method banks and workplaces use, and it protects the one action that reaches your accounts.

Any of these apps work: Google Authenticator, Microsoft Authenticator, Authy, or 1Password.

1

Open the enrollment screen

When you go to connect a bank for the first time, Sumwright shows a QR code and a setup key.

2

Add Sumwright to your authenticator

iPhone & Android
On the same phone, tap “Open in authenticator app.” On a second device, scan the QR code. Or type the setup key by hand.
Mac & Windows
Scan the QR code with your phone’s authenticator app, or enter the setup key manually.
3

Confirm the 6-digit code

Type the current 6-digit code from your authenticator to finish. You’re set — you won’t repeat this for every session.

How your data is protected

Bank connections are read-only through Plaid, and you enter your bank credentials directly into Plaid — Sumwright never sees them. Your data is encrypted in transit and at rest, bank access tokens are additionally encrypted with a managed key service (AWS KMS), and every user is isolated with database row-level security. See the Privacy Policy for the full picture.

PreviousGetting startedNextLinking your bank

Didn’t find what you needed?

Email support@sumwright.com