Perqt is built around a simple promise: you keep full control of what we know, what we store, and who can access it.
01 · The pillars
When you connect a card, Perqt receives a read-only token through Plaid. We can see transaction descriptions, amounts, and dates so we can match them against your card's benefits — but we cannot move money, make purchases, or change anything on your account. You can revoke access anytime by disconnecting the card.
Authentication with your card institution happens inside Plaid's secure flow — your online banking password is never sent to, seen by, or stored on Perqt servers. We only ever receive a tokenized, scoped credential.
Every connection uses HTTPS with TLS 1.2 or higher. All data stored — your wallet, transactions, analytics, preferences — is encrypted at rest using AES-256. Plaid tokens are encrypted with separate keys, Stripe payment data stays in Stripe's PCI-compliant environment, and backups use the same standard.
Our database enforces row-level security policies that make it impossible for one user's queries to return another user's data. Your wallet, transactions, and analytics are only ever returned to a request authenticated as you.
Sign in with email + password or Google. Passwords are hashed with industry-standard algorithms and checked against the Have I Been Pwned breach database to block compromised credentials. Session tokens are short-lived and rotated automatically.
Perqt has no advertising business and no data-broker relationships. We do not sell, rent, or share your personal information, wallet contents, transaction history, or spending patterns with third parties for marketing. Period.
We pull only the transaction fields needed to match purchases to card benefits and generate recommendations: merchant, amount, date, and category via Plaid. We do not store full card numbers, CVVs, PINs, account balances unrelated to a transaction, or Social Security numbers.
Disconnect any card to immediately revoke our Plaid access. Export everything in a machine-readable format or permanently delete your account at any time. Deletion removes your data from active systems within 30 days and from backups within 90 days.
Perqt runs on enterprise cloud providers with SOC 2 Type II certified data centers, automated patching, network isolation, and 24/7 monitoring. Plaid tokens, Stripe payment credentials, and other secrets are stored in an encrypted vault and rotated regularly.
For Coinbase One Card holders, Perqt connects to Coinbase through Plaid — the same read-only bank connection used for every other card in your wallet. We can read card transactions and Bitcoin rewards balances so we can value them against your other cards — we cannot trade, transfer, or move any funds in your Coinbase account. You can revoke access at any time by disconnecting the card in Perqt.
Ask Perqt uses large language models to answer questions about your wallet. When you ask something, we send only the wallet, benefit, and transaction context needed to answer — never your login credentials, full card numbers, or payment data. Our AI provider does not use your prompts to train their models. The assistant can suggest and explain, but it can never move money, apply for cards on your behalf, or take any action outside the conversation.
Security researchers are welcome. If you discover a vulnerability, email contact@perqt.ai. We commit to acknowledging reports within 2 business days, investigating in good faith, and never pursuing legal action for good-faith research.
02 · Data ledger
03 · Your side
