Frequently asked questions

Personal data and financial information for which the user has given explicit consent are stored on secure Amazon Web Services servers in Northern Virginia, USA. We also maintain secure database backups in a controlled local environment, where the information is not stored in plaintext.

Financial data is not permanently stored on the mobile device - it is retrieved from the server while the app is being used. Only protected technical data required for maintaining the session and ensuring the proper operation of BoroBit is stored on the device.

Data is transmitted between the app and our servers through a secure HTTPS connection using TLS 1.2 encryption. The primary database and cloud backups are encrypted at rest using AES-256.

Access to the systems is restricted to a small number of authorized team members and protected with two-factor authentication. Technical session data stored on the mobile device is protected using the built-in security mechanisms of iOS and Android.

You can learn more about how we protect your data and access to BoroBit in our article.

BoroBit uses artificial intelligence to create an informative monthly analysis of your finances. The analysis is generated automatically for the previous month and can also be initiated manually.

To create it, we send the external provider only aggregated totals by category for the period concerned. We do not send your name, email address, bank account number, individual transactions, or any details of the people you have transacted with.

The data is not used to train AI models.

The AI analysis and its related conversation are stored in your profile until your account is deleted. The analysis is for informational purposes only and does not result in automated decisions or financial actions.

Account information services are a regulated activity. The service is provided by Iris Solutions AD — a payment institution licensed by the Bulgarian National Bank to provide account information services under Article 4, item 8 of the Payment Services and Payment Systems Act.

Inabit EOOD, which develops and offers BoroBit, acts as a registered agent of Iris Solutions AD under Article 28 of the same Act. Agents are entered in the register by the BNB, and the activity is carried out on behalf of the licensed institution, which remains liable for it.

You can check both companies in the public register kept by the BNB under Article 19 of the Payment Services and Payment Systems Act — the "Register of payment institutions licensed in the Republic of Bulgaria, as well as of their branches and agents":

https://www.bnb.bg/PaymentSystem/PSPaymentOversight/PSPaymentOversightRegisters/index.htm

The same information is also available in the central register of the European Banking Authority, which brings together the data from all Member States.

You can read more about the relationship between the two companies in the Terms and Conditions.

When you delete your account, your profile and the data associated with it are removed from the active system. This includes your personal settings, bank accounts, balances and transactions, categories, Pockets, AI conversations and monthly analyses. The data also stops being visible to members of any linked families or organisations.

Copies of the information may remain in our secure backup archives for up to 30 days, after which they are deleted.

Limited technical identifiers may remain in system security logs, but they are not used to restore your profile or provide the service. Data is retained for longer only when required by applicable law.

No, you should never share your online banking username and password with anyone, including BoroBit.

How does the process work?
To link your bank accounts to BoroBit, you need to have online banking activated.

1. When adding an account, BoroBit will redirect you to your bank’s official system.
2. You will log in to your online banking directly through your bank, without sharing your login credentials with BoroBit.
3. During this process, you will select which of your accounts to connect and grant BoroBit access only to retrieve balance and transaction data.

How long is the access valid?
The access you grant at your bank is time-limited and needs to be renewed periodically — this is what open banking rules require. We will notify you before it expires.

If you do not renew it, the account moves to a "disconnected" state: BoroBit stops receiving new data for it, but your financial history remains. The last balance is shown with the date it refers to, and it does not count towards your current total. Once you renew the access, the account is connected again and the history continues.

This process is fully secure, regulated, and supported by all banks within the European Union.

If you have any further questions, feel free to contact us – we’re happy to help!

The access you grant at your bank is time-limited. When it expires, the account moves to a "disconnected" state:

• BoroBit stops receiving new transactions and balances for it;
• your financial history remains intact;
• the last balance is shown with the date it refers to, and it does not count towards your current total.

You renew the access directly from the account screen. Your history is kept and is topped up with the new data. The bank may provide information for a limited period back.

BoroBit offers an app lock feature to enhance security. You can protect access using biometric authentication (such as facial recognition or fingerprints) or a system PIN/pattern—depending on what your device supports.

You can customize the auto-lock duration and choose when the app should require reauthentication.

To configure these settings, go to Menu → Security and adjust the protection according to your preferences.

Note: Security features may be improved with future updates, so we recommend keeping BoroBit up to date.

You can learn more about security at BoroBit in our article.