How we protect your data

EKKO connects to your bank through Akahu - a New Zealand open banking company, connected through Enduring Connectivity (a read-only connection type). Akahu acts as a secure bridge. EKKO’s own formal accreditation path is still being finalised. You authenticate directly with your own bank. EKKO never receives, stores, or sees your bank login credentials at any point.

• ✗EKKO never stores your bank username or password
• ✗EKKO cannot initiate transfers to any account that is not yours
• ✗EKKO cannot access accounts you have not explicitly linked
• ✓Akahu tokens are encrypted at rest using AES-256-GCM
• ✓Tokens are never logged and never included in any client-side code
• ✓EKKO only reads balances - we never write to your bank

You can revoke access at any time from your EKKO profile, or directly at my.akahu.nz. Disconnecting immediately stops all future balance reads.

All EKKO data is stored in a PostgreSQL database managed by Supabase. Every table has Row-Level Security (RLS) enforced at the database layer - not just the application layer. This means the database itself enforces that you can only read and write your own records, regardless of how the application is queried.

• ✓RLS is enabled on every table - no exceptions
• ✓User data queries require a valid authenticated session
• ✗The service role key is never exposed to the browser bundle
• ✗Raw database errors are never returned to the client

Authentication is handled by Supabase Auth. All API routes validate your JWT server-side before processing any request - client-submitted identity claims are never trusted.

• ✓JWT validated server-side on every request
• ✓Gold tier requires TOTP-based MFA (AAL2) for every session
• ✓Tier and game state always read from the database, never from client input
• ✗Client-submitted tier values are never trusted or acted on

Every Judgment Day result - your balance at the time, your High Water Mark, and the outcome - is written to an append-only audit log. A PostgreSQL trigger blocks any UPDATE or DELETE on this table. The log is immutable by design.

• ✓Audit records are retained for 7 years from the date of each event
• ✓Any disputed game outcome can be independently verified from the log
• ✗No Judgment Day result can ever be altered after the fact

• ✗See your bank login credentials
• ✗Move money to any account that is not yours
• ✗Access financial data from accounts you have not connected
• ✗Use AI or probabilistic systems in the game engine - all outcomes are deterministic and auditable
• ✗Retain Akahu-sourced data after you disconnect (except the 7-year audit snapshots)
• ✗Share your data with third parties for advertising

If you discover a security vulnerability, report it to us before disclosing it publicly. We take all reports seriously and respond quickly.

• ✓Email chow@ekko.nz with a description and reproduction steps
• ✓We acknowledge all reports within 48 hours
• ✓We aim to resolve critical issues within 7 days of confirmation
• ✗We ask that you do not publicly disclose the issue until we have resolved it