Is Empower Safe

Empower offers free budgeting tools. But is it safe to link all your financial accounts? Learn just how secure Empower is.

What Is Empower?

Empower is a convenient, all-in-one personal finance toolkit. You can link all your accounts (bank accounts, credit cards, loans, and investments) for a complete snapshot of your finances, including:

• Transactions
  
• Account balances
  
• Portfolio performance

But are there risks in keeping all of your financial info in one place? Read on.

Security Concerns

Security is a huge concern in face of the massive data breaches in recent years. Is it really safe to link all your financial accounts, supply passwords, and store the info in the cloud?

There are two main security concerns:

1. Data Transmission: How safe is it when you enter bank account information, passwords, etc.?

2. Data Storage: How does Empower protect and store your data? Can employees and hackers see your credentials?

Let's take a look at Empower's security and answer these questions.

How Empower Encrypts Your Data

Empower uses very strong encryption to hide your data. This includes:

• Multi-layer key management, including rotating user-specific keys and salts

• TLS v1.2 protocol to establish a secure channel when sending information

• ECDHE key exchange for Perfect Forward Secrecy

• 256-bit AES encryption, which is basically military-grade encryption used by the U.S. government

All that probably means nothing to you, so let's put it very, (very) simply:

Every time you log in and transmit information, Empower encrypts (or hides) your data by using a coded cipher. Basically, it scrambles your data so snoopers can't read it.

The data is sent over a secure encrypted channel to their servers. The encrypted message can only be solved by a shared secret key between your device and their server. A new unique key is generated every time you communicate information with Empower. The key is never stored or reused. This way, past sessions can never be decrypted.

Your data is encrypted both when being transmitted and when stored. No one has access to your credentials.

Other Security Measures

Other security measures include:

• Secure Servers
  Empower's data centers are protected with numerous perimeter security and firewalls. The data centers operate under stringent financial and international security standards.

• Secure Data Storage
  Your credentials are stored with Yodlee, not in Empower's database. That means that no one, including a hacker, can access your login data from the Empower interface. This provides an added layer of security (more on this later).

• Strict Internal Access Controls
  No one at Empower has access to your credentials.

• 2-factor Authentication
  This requires you to authorize each new device to make sure it's really you.

• Extra Mobile Protection
  Get extra log-in protection on the mobile app via Touch ID (on iPhone) or PINS (on iOS and Android).

• Regular Third-Party Security Audits
  This includes a year-round private bug bounty program with Bugcrowd. Empower also uses Verisign and other security solutions to protect the site.

What Happens if Empower Gets Hacked?

Even if Empower's data center gets hacked, or if someone gets into your account, your information would still remain secure. Empowers platform is read-only - no one has access to your accounts except you. No one can perform any actions on Empower, such as moving money out of an account. Not even you.

So if a hacker somehow breaks into your account, they would only be able to read your financial information. They wouldn't be able to withdraw, transfer, or spend your funds. Your money still stays in your various financial accounts.

A hacker also would not be able to get the usernames and passwords to your accounts. Empower never sends credentials to your browser. Your login information will never be exposed.

Does Empower Store Information?

Empower does NOT store your bank and brokerage credentials in their own database. Instead, they're stored at Yodlee, a leading provider in the financial data aggregation business.

Yodlee is the one that accesses your accounts, stores your credentials, and provides your data to Empower. Empower merely displays the information for you.

So the real question is: how safe is Yodlee?

Yodlee has bank-level security and is supervised and audited by the federal government. It adheres to strict security and risk management standards. This includes:

• 256-bit AES encryption

• Multiple layers of firewalls

• All client credentials are encrypted both when entered and when stored

• No human access to databases

• Multiple layers of intrusion detection systems running 24/7

• Frequent security audits by financial institutions (nearly 200 audits in the past 24 months)

Hundreds of banks trust Yodlee to provide financial technology services. Chances are, you're already using Yodlee and don't even know it. Yodlee has no security breaches to date.

So Is Empower Safe?

Empower is safe to use to track your bank and credit cards, net worth, and investments. It uses military-grade 256-bit AES encryption to keep your credentials safe. Your money is not at risk when you link your accounts, as Empower is read-only and no one can move your funds.

While nothing you do online is 100% safe, Empower has put all the necessary protections in place to protect your data.

You could argue that using Empower to view your finances is safer than logging in directly to your various banks from your browser. Here's why:

• Your laptop is less secure than a data center. It only takes accidentally downloading malware to compromise your computer.

• You risk exposure every time you log into your bank account. With Empower, you don't enter your bank credentials each time, so they're not transmitted.

• Empower has the ability to maintain state-of-the-art security measures more than you do.

• Empower is read-only. You can't actually perform any actions. So a hacker wouldn't be able to move money out of your accounts.

Does Empower Share Your Information?

According to Empower's privacy policy, it never sells or trades your personal information. Empower does share some of your information with their service providers in order to deliver their services.^[1]

For example, if you're an Empower Personal Cash or Advisory client, some of your information will be shared with third-party identity verification providers and fraud analysis partners. This is required in order to verify you and prevent fraud.

Your information is also only shared with their marketing partners for the sole purpose of marketing their own products to you. Empower never shares your detailed financial information, like account numbers.

Bottom Line

Nothing is 100% safe, but Empower has taken exhaustive steps to prevent your data from being stolen. It uses the strongest encryption available and the highest security measures.

Keeping all your accounts in one place is actually safer, since you don't have to keep entering your login info on each separate banking or investment website. In the event that your information is compromised, there is no risk of losing money.

References