Your money. Your data. Your control.
Reallo connects through Akahu, New Zealand's open banking network. Here's exactly how your money and data are protected.
Works with every major NZ bank
Powered by
How Reallo protects your money and data
We check the account is yours
Reallo connects through Akahu and never sees your bank login. It only pays out from a bank account you've connected and we've checked is yours.
We never hold your money
Every move runs straight from your bank to a destination set up in Reallo: one of your own connected accounts for cash, or the provider's own account with your reference for KiwiSaver and investing. Reallo is never in the middle holding your balance.
You choose where it goes
Reallo never makes investment choices for you. You choose the destination type and your reference. For cash that is one of your own connected accounts. For KiwiSaver it is Inland Revenue's KiwiSaver account with your IRD number. For investing it is the platform's deposit account with your account reference. Change it or stop the whole thing in one tap.
Encrypted where it counts
Every connection is encrypted in transit. The secrets that matter most, your two-factor secret and the tokens that read your bank data, are individually encrypted with AES-256 before they are stored. Everything else sits on encrypted disks at our hosting providers.
We never sell your data
Your data is yours. We will never sell it, and we only ever use it to work out what your cashflow can spare and move it at the pace you set.
Disconnect anytime
Change your mind and you can disconnect your bank and close your account whenever you like.
Reallo is built in Aotearoa, for the way New Zealanders actually spend.
We're a savings app. We move your money and we read your transactions, so security isn't a feature for us. It's the product.
Independently penetration tested
In June 2026 we commissioned an independent penetration test from phew, approved by CREST ANZ, the cybersecurity accreditor for Australia and New Zealand. Their testers hold OSCP, OSWE, OSCE and CISSP certifications.
We chose a grey-box engagement, which means we gave them our source code and working accounts rather than making them guess. It's the harder test to pass. Findings were remediated and re-tested, with commits through 26 June 2026 covered in the re-test. At the report date, no vulnerabilities remained open and exploitable.
- Grey-box test: full source code + credentials
- OWASP Top 10, Testing Guide v4
- 0 open vulnerabilities at June 2026 report
The full attestation letter from phew is available on request: email developer@reallo.co.nz.
Your bank connection
We never see or store your bank login. Akahu handles the connection to your bank, and we only ever receive the data you've agreed to share.
Reallo does move money, and every move is a payment to a destination set up in Reallo: for cash, one of your own connected accounts; for KiwiSaver, Inland Revenue's KiwiSaver account with your IRD number as the reference; for investing, the platform's deposit account with your account reference. It never lands in a Reallo account, we never hold your balance, and nothing else about your bank account can be changed.
You can revoke Reallo's access at any time, from inside the app or from your Akahu account. Every revocation is logged.
Data retention
When you close your account, we delete your data from our live systems straight away. A few things stay behind for a while, and our Privacy Policy lists each one and how long it stays.
Security and audit records are kept after deletion for security investigations. They are unlinked from your user record, but an entry can keep the IP address it came from, and its details can include your email address, a masked bank account number, a masked phone number, merchant or subscription names, and Akahu's IDs for your accounts and payments.
Reporting a vulnerability
If you believe you've found a security issue in Reallo, email developer@reallo.co.nz. We aim to acknowledge within two business days and we'll keep you posted until it's resolved.
Common questions about safety
Is Akahu safe?
Yes. Akahu is New Zealand's open banking provider, trusted to connect banks with apps securely. The major banks connect through NZ's official open banking APIs, and other institutions connect through Akahu's own secure integrations. Reallo never asks for your login.
Is open banking safe in New Zealand?
Open banking in New Zealand lets you securely share specific bank data with apps you choose, through providers like Akahu, without handing over your login. Reallo only ever reads your transactions and only ever sends money to a destination set up in Reallo. For cash that is one of your own connected accounts. For KiwiSaver and investing it is the provider's own account, Inland Revenue or the platform, sent with your IRD number or account reference.
Can Reallo see my bank login or password?
No. Reallo connects through Akahu and never sees your bank login or password.
Can Reallo move my money anywhere it wants?
No. Reallo only pays out from a bank account you've connected and we've checked is yours, and only ever to a destination set up in Reallo. For cash that is one of your own connected accounts. For KiwiSaver, the payee is fixed as Inland Revenue's KiwiSaver account and you supply your IRD number. For investing, the payee is fixed as the platform's deposit account and you supply your account reference. Reallo cannot send money to any other payee.
Does Reallo hold my money?
No. Every move runs straight from your bank to a destination set up in Reallo: one of your own connected accounts for cash, or the provider's own account with your reference for KiwiSaver and investing. Reallo is never in the middle holding your balance.
Is my data encrypted?
Yes. Every connection is encrypted in transit, and the secrets that matter most, your two-factor secret and the tokens that read your bank data, are individually encrypted with AES-256 before they are stored. Everything else sits on encrypted disks at our hosting providers. And we never sell your data.
Does Reallo make investment decisions for me?
No. Reallo never makes investment choices for you. You choose the destination type, cash, KiwiSaver or investing, and your reference, and you can change it anytime.
What if I want to stop?
Go to Settings, then Weekly moves. Pause skips your moves until you resume. Stop ends them, and you can tick a box to remove your bank approvals too. Nothing is locked in, and you can still close your account whenever you like.
Ready to let Reallo do the work?
Join the waitlist and we'll be in touch as soon as Reallo is open.
Join the waitlistBank-grade encryption · Never holds your money · NZ owned and operated