Security, in plain language

You're keeping records about someone who trusts you. Here's exactly how PayeeKit protects them, with every technical term explained.

Encrypted on your device

Everything PayeeKit writes, including the database, receipt photos and exported documents, is protected using Apple's Data Protection at its strongest available setting. In practice, that means the files are encrypted using keys tied to your device passcode, and they're unreadable while your device is locked.

Encrypted in transit, to your own iCloud

When your records sync between your devices, they travel through Apple's CloudKit service over an encrypted (TLS) connection, into the private iCloud database tied to your own Apple Account. There is no PayeeKit server in that path. The Privacy Policy has the full picture.

Locked behind Face ID or Touch ID

PayeeKit requires Face ID, Touch ID, or your device passcode to open, and again after the app has been in the background for a length of time you choose: immediately, after 1 minute, after 5 minutes, or not at all. Turning the re-lock off only affects backgrounding. The app still asks for your passcode or biometrics the moment it launches, as long as your device itself has one set up.

Nothing sensitive left visible

When you switch away from PayeeKit, the app preview shown in iOS's App Switcher is covered, so it doesn't show ledger amounts, beneficiary names, or the last four digits of a Social Security number in the clear.

No third-party code watching your data

• No third-party SDKs of any kind embedded in the app.
• No analytics, no usage tracking, no advertising identifiers.
• No crash-reporting service. The app doesn't phone home when something goes wrong.

Screenshots are not blocked or detected anywhere in the app. On purpose: a payee sometimes needs to share a screen with a caseworker or a family member, and PayeeKit isn't going to fight you over that.

Data minimization, by design

PayeeKit is built to ask for no more than it needs:

• The Social Security number field takes only the last 4 digits, and there is no field anywhere in the app for a full SSN. A document or photo you add is stored as it is, so a scanned letter keeps any number printed on it.
• PayeeKit never asks for a bank account or routing number, and has no field for one. There is no linked-account feature; every deposit and expense is typed in by you. A bank statement you scan keeps whatever is printed on it.
• No information about the people you serve is ever transmitted to us, because there is nowhere for it to go. The Privacy Policy explains.

You control export and deletion completely

The export in Settings produces a zip at any time: each beneficiary's entries and receipt photos from the last three years, all of their documents, and all of their guardian records. Keep it for the two years of records SSA expects, or as your own backup. PayeeKit Plus adds a spreadsheet of every transaction across every period. Deleting a single beneficiary or using Delete everything removes the corresponding records from your device and your iCloud private database; there is no server-side copy left behind anywhere.

Questions or a concern to report

If you believe you've found a security issue in PayeeKit, please email support@payeekit.com with details. We will respond directly.