Security

How Pikt protects your data

Add cards by name — never card numbers. Pikt recommends which card to use and never pays for you. Bank linking is optional and read-only when you turn it on.

Add cards by name

Pick the cards you carry from the catalog. We store which products you selected — never full card numbers, CVVs, or PINs.

Pikt recommends — you pay

Pikt names the best card in your wallet and shows the dollar difference. You always pay with your own card. We never issue a card or move your money.

Bank linking is optional

Card Check and Pikt Checkout work without a bank link. If you connect a bank later, access is read-only for bills and spend insights — we cannot move, send, or withdraw money.

Secure connections via Plaid

You authorize access through Plaid or your bank. Pikt receives account data and an access token, not your bank password. An access token lets Pikt retrieve the data you authorize.

Secure connections via Quiltt

You authorize access through Quiltt and its bank connection providers. Pikt receives account data and connection identifiers, not your bank password.

Encryption for sensitive records

Pikt uses HTTPS to protect data sent between your browser and our service. Stored Plaid access tokens and dates of birth use AES-256-GCM encryption. These controls do not mean that Pikt has completed a security certification.

Disconnect anytime

Disconnect in Settings → Cards & bank to stop new imports. Pikt revokes Plaid access and removes its Quiltt connection. Removing a Quiltt connection does not revoke access at the provider; contact support for help with that step. Previously imported history stays until deleted or its retention period ends.

Not yet completed: our own SOC 2 audit and independent penetration test. Both are planned.

What we store — and what we do not

We store

• Card product names and identifiers, plus account details and last four digits if linked
• Spending categories and merchant types used to select your best card
• Which card we selected for each purchase, and why
• Name, email, account preferences, and an encrypted date of birth for the age check
• Linked-bank balances and transaction history, including merchants, dates, and amounts

We never store

• Bank passwords entered through the bank connection provider
• Full card numbers, CVVs, or PINs
• Social Security Numbers or government-issued IDs
• Permission to initiate bank payments or transfers

The browser extension: permissions and data

There is no card vault

• Pikt never stores, receives, or transmits your card number, expiry, or security code — on your device or ours — in any form
• Chrome fills it, not Pikt: we point at the card-number field on your own click, and Chrome's own saved-card autofill fills in whatever you've saved at chrome://settings/payments
• There's no “save a card” step and nothing to sync

What the extension can access

• Pikt runs on websites you visit to detect checkouts and show card offers. It sends checkout details to Pikt for recommendations, plus usage and error reports. Saving checkout history is optional and off by default. See the Privacy Policy for exactly what leaves your device
• Recommendation requests go to Pikt. Search offer matching runs in your browser. You can limit site access or remove the extension in Chrome.
• No bank credentials, ever — bank access stays read-only, same as the web app
• At checkout you may see a card offer — an issuer deal at that store on a card you already have. Whichever card we name, our estimated best pick from your wallet is shown alongside it when we can produce one, so you can see what we'd have said either way

How recommendations stay independent

How we get paid

• Pro subscriptions are the primary way we get paid after beta
• Some “See card offer” links use Pikt's apply redirect to count the click; most open the issuer's site. Pikt earns $0 if you apply today. If we later earn a referral fee, rankings stay by value to you, never by commission. If that changes, we will say so in Pricing and next to the link.
• We don't sell your data. Sponsored placements, when shown, are labeled.

What does not change

• When our estimate finds a clear unpaid winner in your wallet, we show that pick first (estimates; not a guarantee).
• We never move your money or pay on your behalf
• Full commercial details are in Pricing

If something goes wrong

If a security incident affects your data, we will notify affected users as required by applicable law and explain what happened and what to do next. To report a security concern, email [email protected].

Testing, retention, and your rights

Penetration testing

Independent third-party testing is planned, not yet completed. We plan annual tests ahead of releases that touch authentication, payments, or bank connectivity. Summary findings will be available to qualified partners under NDA once testing completes.

Data retention

Website deletion requests have a 14-day recovery period after email confirmation. Permanent deletion follows within 90 days unless a legal hold applies. In-app deletion on iOS or Android starts permanent deletion immediately, with no recovery period. Some audit and deletion-proof records remain. Analytics events carry an account identifier and stay for up to 12 months unless you request earlier removal. See the Privacy Policy retention details.

CCPA requests

Access and deletion requests are handled within 45 days at [email protected]. A formal CCPA program review is underway. The optional Pikt Personal program and exactly what it collects are covered in our Privacy Policy.

Infrastructure providers

Pikt has not completed its own SOC 2 audit. Our providers publish their own security information: hosting (Vercel (opens in a new tab)), our database (Railway (opens in a new tab)), authentication (Clerk (opens in a new tab)), and bank connections (Quiltt and Plaid). Provider reports cover their own systems. They do not certify Pikt. See each provider's trust center for current information.

Request a security report

Evaluating Pikt for your organization? Request our security documentation. Penetration test summaries will be shared once testing completes.

Request security report

Pikt is operated by Pikt Rewards. Have a security question or want to report a concern? Email [email protected].

Disconnect anytime