Standards and regulation
PSD2: bank aggregation through regulated providers and a read-only connection.
GDPR: data processed in line with European regulation.
Security and regulatory
compliance at Orama
Your financial data is the most sensitive thing you hold. At Orama we protect it with encryption and with PSD2 and GDPR compliance. Orama doesn't connect to your banks directly: bank aggregators regulated by the Bank of Spain and ISO/IEC 27001 certified do, over a read-only connection. All on servers in the European Union.
30-min demo · 7-day free trial, no card required
Read-only PSD2 connection
Bank ABank BBank C
🔒Encrypted data
✓Permissions per user
Feature
How Orama protects your data
Infrastructure and data protection
Servers in the European Union (Belgium and Germany), HTTPS-encrypted connections and encrypted disks. On top of that, Orama encrypts the most sensitive data field by field (bank authorisations, IBANs, balances and limits) and keeps the keys separately. The connection to your banks is read-only: Orama can never move your money.
Data protection
Bank ABank BBank C
🔒Encrypted data
✓Read-only: never moves your money
Frequently asked questions
Can Orama move my money?+
No. The PSD2 bank connection is read-only: Orama reads balances and transactions to analyse them, but cannot initiate payments.
Where is my data stored?+
On servers in the European Union (Belgium and Germany), with top-tier cloud providers and GDPR compliance. Your data is encrypted, and the most sensitive fields, such as IBANs, balances and bank authorisations, are also encrypted one by one.
How secure is the connection to my bank?+
Orama doesn't connect to your banks directly: bank aggregators regulated by the Bank of Spain and ISO/IEC 27001 certified by AENOR do, over a read-only connection, so Orama can never move your money. Your data is also stored encrypted.
Does Orama store my bank credentials?+
No. Orama never sees or stores your bank credentials: you enter them on the bank aggregator's screen.
Is my data used to train AI?+
No. Orama's AI runs on Anthropic's API, which under its commercial terms does not use that data to train its models. And if you connect your own AI through the MCP, it only sees what your user can see, with a permission that is off by default.
Can I log out of a device I've lost?+
Yes. In User profile › My devices you see every device you've signed in from and can end the session on any of them instantly.
Orama Academy
Learn how to get the most out of Orama. Guides, videos and training, step by step.
Go to Orama AcademyStart controlling your cash flow this week
7 days free. No card. No commitment. And if you'd like us to walk you through it, we'll book a 30-minute demo.