Security, in plain language

You're keeping records about someone who trusts you. Here's exactly how PayeeKit protects them, with every technical term explained.

Encrypted on your device

Everything PayeeKit writes, including the database, receipt photos and exported documents, is protected using Apple's Data Protection at its strongest available setting. In practice, that means the files are encrypted using keys tied to your device passcode, and they're unreadable while your device is locked.

Encrypted in transit, to your own iCloud

When your records sync between your devices, they travel through Apple's CloudKit service over an encrypted (TLS) connection, into the private iCloud database tied to your own Apple Account. There is no PayeeKit server in that path. The Privacy Policy has the full picture.

Locked behind Face ID or Touch ID

PayeeKit requires Face ID, Touch ID, or your device passcode to open, and again after the app has been in the background for a length of time you choose: immediately, after 1 minute, after 5 minutes, or not at all. Turning the re-lock off only affects backgrounding. The app still asks for your passcode or biometrics the moment it launches, as long as your device itself has one set up.

Nothing sensitive left visible

When you switch away from PayeeKit, the app preview shown in iOS's App Switcher is covered rather than showing ledger amounts, beneficiary names, or the last four digits of a Social Security number in the clear.

No third-party code watching your data

• No third-party SDKs of any kind embedded in the app.
• No analytics, no usage tracking, no advertising identifiers.
• No crash-reporting service. The app doesn't phone home when something goes wrong.

Screenshots are not blocked or detected anywhere in the app. That's a deliberate choice: a payee sometimes needs to share a screen with a caseworker or a family member, and PayeeKit isn't going to fight you over that.

Data minimization, by design

PayeeKit is built to ask for no more than it needs:

• Only the last 4 digits of a Social Security number can ever be entered or stored. There is no field anywhere in the app for a full SSN.
• PayeeKit never asks for, stores, or displays a bank account or routing number. There is no linked-account feature; every deposit and expense is typed in by you.
• No information about the people you serve is ever transmitted to us, because there is nowhere for it to go. The Privacy Policy explains.

You control export and deletion completely

Settings → Export all records produces a zip of each beneficiary's ledger for the last three years, their documents, receipt photos and guardian records, at any time. Keep it for the two years of records SSA expects, or as your own backup. PayeeKit Plus adds a spreadsheet of every transaction across every period. Deleting a single beneficiary or using Delete Everything removes the corresponding records from your device and your iCloud private database; there is no server-side copy left behind anywhere.

Questions or a concern to report

If you believe you've found a security issue in PayeeKit, please email support@payeekit.com with details. We will respond directly.