How we use AI

Our development tools can access source code. They are not connected to customer accounts, transactions, or the production systems that store financial data.

Curl Budget can use AI to categorize transactions. Because this feature works with your data, it stays off until you turn it on.

• Off by default. Nothing is sent to an AI provider unless you enable the feature.
• On-device models are available. On compatible phones, categorization can run without financial data leaving the device.
• Cloud requests are limited. If you choose cloud AI, we send only the information needed for that feature.

Read more about AI categorization and how we handle data in Data Protection.

Every change is submitted as a pull request and reviewed by an experienced software engineer before it can merge. AI reviewers from multiple vendors also look for bugs, security problems, and regressions. Their feedback is advisory: a person makes the final decision.

Automated checks run on every change. Scheduled end-to-end tests also run on iOS simulators and Android emulators.

• Unit tests check individual functions and components.
• Integration tests run against a real database and backend server.
• End-to-end tests exercise complete user journeys in the app.
• Type-checking and static analysis inspect the whole codebase, and new code must meet a test-coverage threshold.

We maintain several layers of protection for the code, infrastructure, and data behind Curl Budget.

• Dependency updates address known vulnerabilities as fixes become available.
• Automated scans check code, dependencies, and cloud configuration for security problems.
• Encryption protects data in transit and at rest. See Data Protection for details.

Production access requires layered authentication

Those layers include hardware-backed biometric verification and one-time security codes.

Questions? Visit the support page.