Encryption is the reason you can link your bank account to an app without handing over plaintext access to your transaction history. When done correctly, encryption makes stolen data useless — an attacker who breaches a database gets scrambled noise instead of readable account numbers and spending records.
Mora encrypts your financial data twice: once when it travels from Plaid to Mora's servers (encryption in transit), and again when it is written to disk (encryption at rest). The keys used for encryption are unique to your account, so even Mora's own engineers cannot read your data without your explicit authorization.
Encryption in Transit: Protecting Data as It Moves
Every time Mora syncs your accounts, the data travels over the internet from Plaid's servers to Mora's AWS infrastructure. That connection uses TLS 1.3, the same protocol that protects your online banking session and every HTTPS website you visit.
TLS encrypts the data before it leaves Plaid's servers and decrypts it only after it arrives at Mora's servers. An attacker intercepting the connection — say, by compromising a Wi-Fi router or a network switch — would capture encrypted packets that cannot be decoded without the session key.
Why TLS Matters for Finance Apps
TLS is standard for any app handling sensitive data, but not all implementations are equal. Mora uses TLS 1.3 with modern cipher suites and enforces certificate pinning, which prevents man-in-the-middle attacks even if a certificate authority is compromised.
If you use Mora on public Wi-Fi, your transaction data is protected by the same encryption that secures a direct connection. The app does not trust the network — it trusts the encryption.
Encryption at Rest: Protecting Stored Data
Once your transaction history reaches Mora's servers, it is encrypted again before being written to the database. Mora uses AES-256 encryption, the same standard used by the U.S. government for classified information and by banks for customer records.
The encryption key is unique to your account. If an attacker gained access to Mora's database — through a breach, a stolen backup, or a rogue employee — they would get encrypted blobs that cannot be decrypted without your key.
Per-User Encryption Keys
Most apps encrypt their entire database with a single master key. That approach protects data from external attackers, but it means anyone with access to the master key (including the company's own engineers) can read every user's data.
Mora uses per-user encryption keys instead. Your transaction history is encrypted with a key derived from your account credentials, and that key is stored separately from the data itself. Even Mora's engineers cannot decrypt your data without going through an audited access-control process that logs every request.
Key Management and Rotation
Encryption is only as strong as the key management system. Mora stores encryption keys in AWS Key Management Service (KMS), a hardware-backed system designed for cryptographic key storage. KMS handles key generation, rotation, and access logging, and it is audited by third-party security firms.
Keys are rotated automatically on a regular schedule. When a key is rotated, Mora re-encrypts your data with the new key in the background. You never notice the rotation, but it limits the window of risk if a key is ever compromised.
What Happens If You Forget Your Password?
Because Mora uses per-user encryption keys, losing your password means losing access to your encrypted data. Mora cannot decrypt your transaction history without your key, and the key is derived from your password.
That trade-off is intentional. It means Mora cannot be compelled to hand over your data to a third party, because Mora does not have the technical ability to decrypt it. It also means you should use a strong, memorable password and enable two-factor authentication to protect your account.
Encryption Does Not Protect Against All Threats
Encryption protects data in transit and at rest, but it does not protect against attacks that happen while data is in use. If someone steals your phone and it is unlocked, they can open Mora and see your transaction history — the app has already decrypted the data to display it.
That is why Mora supports biometric login (Face ID, Touch ID, fingerprint) and automatic session timeouts. If your phone is stolen, the attacker has a narrow window to access the app before it locks again.
Phishing and Social Engineering
Encryption also does not protect against phishing. If you enter your Mora password into a fake login page, the attacker gets your plaintext password and can log in as you. Mora cannot distinguish between you and someone who has your credentials.
The best defense is to verify the URL before entering your password (always getmora.ai, never a look-alike domain) and to enable two-factor authentication, which requires a second proof of identity even if your password is stolen.
How Mora's Encryption Compares to Traditional Banking
Your bank encrypts your data in transit and at rest, but most banks do not use per-user encryption keys. That means bank employees with the right access level can view your transaction history, and law enforcement can request readable records with a subpoena.
Mora's per-user encryption model offers stronger privacy guarantees. Even if Mora receives a subpoena, the company cannot hand over plaintext transaction data without your cooperation, because it does not have the key to decrypt it.
Trade-Offs of Strong Encryption
The downside of per-user encryption is that Mora cannot offer account recovery if you forget your password. Traditional banks can reset your password because they control the encryption keys. Mora cannot, because you control the key.
That trade-off makes sense for a finance app where privacy is a primary concern. If you want the convenience of easy password recovery, you accept weaker encryption. If you want strong encryption, you accept the responsibility of managing your own credentials.
Verifying Mora's Encryption Claims
Mora publishes technical details of its encryption implementation at getmora.ai, including the algorithms used (AES-256, TLS 1.3), the key management system (AWS KMS), and the third-party audits that verify the implementation.
If you are evaluating Mora for your own use or recommending it to others, you can request a copy of the most recent security audit or ask specific questions about the encryption architecture. Mora's security team can provide documentation and answer technical questions before you link an account.
