How Duet protects your money and data

We can never move your money

Duet connects to your bank through Australia's Consumer Data Right (CDR) via an accredited data provider. That access is read-only by design — we can see balances and transactions you consent to share, and nothing else. There is no mechanism in Duet to make payments, transfer funds, or touch your money in any way.

We never see your bank login

You authenticate directly with your bank when you connect an account. Your banking username and password are never entered into Duet and never pass through our systems. You can revoke Duet's data access at any time — from Duet or from your bank.

How your data is protected

• All traffic is encrypted in transit (TLS).
• Bank-connection tokens are stored encrypted; passwords are stored only as salted one-way hashes.
• Sessions use short-lived tokens with rotating refresh tokens that are revoked on password reset.
• Sensitive account access is recorded in an append-only audit log.

Your partner can't act alone — and neither can you

Duet is built for couples, so consent is structural: changes to anything shared (budgets, your mortgage split, couple goals) require both partners to agree before they apply, and each partner controls how much of their own accounts the other can see.

What we don't do

• We don't sell your data, ever.
• We don't infer life events from your spending — planning signals in Duet are only ever things you've told us directly.
• We don't provide financial advice; Duet is a tool for organising facts you enter and data you consent to share.

Your data is yours

• Download it any time: Settings → Export your data gives you your transactions, a monthly summary, and a record of who paid what, as spreadsheet (CSV) files that open without Duet.
• Delete it any time from Settings → Delete account. You're signed out and our bank access is withdrawn immediately; your personal data is deleted after a 7-day window in which you can change your mind. Shared history stays for your partner, with your name removed.
• If we ever decide to close Duet, we'll email you at least 60 days before the service stops. Export keeps working throughout, so you can take a full copy of your history. After the service stops, we stop all bank data access and delete your data within 30 days.

Found a vulnerability?

We want to know. Email hello@duetmoney.com.au with the details and we'll respond promptly. Please don't access other people's data while demonstrating an issue.