Product · privacy
You are handing over your money. Here is where it goes.
Every finance app asks for this and most answer with a policy page. This is the specific version: the cities, the companies, the switch, and the screen inside the app that shows you what actually left.
It sits in the EU
The application runs in London and the database, your ledger itself, is in Amsterdam. Both are managed infrastructure behind a firewall: the database accepts no connection from the open internet. Nothing about your ledger lives on a laptop or in somebody's spreadsheet.
Support cannot open your books
There is a back office for the people who run Orla, and what it shows about a customer is the shape of their account: plan, connections, whether a sync is failing. Reading someone's transactions is not a screen that exists, so it is not a habit anyone can fall into. Every staff action against your account is recorded and shown to you, and for almost every customer that count reads zero.
Encrypted before it touches the disk
Uploaded receipts, statements and documents, bank and exchange credentials, what a scan read out of a statement, and card identity data are all encrypted with a rotating key. A stolen database dump is ciphertext. Wallet keystores are ciphertext we could not open in any case: the seed is encrypted in your browser and never sent.
One switch stops the AI
Copilot, category suggestions, statement scans and receipt reading send data to Anthropic. That is what makes them work, and it is a thing some people simply do not want. One switch in Settings turns all of it off for a space, checked in a single place so no path quietly survives it. It is separate from your plan: switching it off does not change what you pay.
A log of what left
Inside the app, a page lists the moments something crossed out: a file downloaded or shared to an address, an export taken, a question answered by a model, an agent reading, an action by Orla staff. Ordinary screen views are not recorded, because watching you is a poor way to prove we do not. In a family or a group everybody sees only their own crossings, the owner included; a business space is the one place where an owner sees all of them, because there the question is whether the client list walked out.
Read-only where it counts
Bank links run in the provider's own window, so your banking password never reaches Orla. Exchange keys that carry trade or withdrawal rights are refused outright where the exchange lets us check. Orla holds a record of your money and, by construction, no way to move it.
Yours to take or erase
Export the whole space as a ZIP of JSON files whenever you like, no ticket and no waiting. Delete the account and your files and sign-in methods are erased, with what remains anonymised so shared ledgers other people rely on do not break.
- Application
- London, United Kingdom
- Database
- Amsterdam, Netherlands (EU)
- Encrypted at rest
- Uploads · provider secrets · scan extracts · card KYC · wallet keystores
- Staff access to your ledger
- None: no screen exists for it
- AI processing
- One switch per space, independent of your plan
- Access log
- Exports, downloads, email shares, model calls, agent reads, staff actions
- Who reads the log
- Family and group: your own only. Business: the owner sees all
- Bank connections
- Read-only, in the provider's window
- Sold to anybody
- Never
- Export
- Whole space as JSON, on demand
- Deletion
- Files and sign-in methods erased, record anonymised
Can anyone at Orla read my transactions?
No screen in the back office shows them. What support can see is the shape of your account: plan, connections, sync health. Whatever they do is logged and shown to you on the privacy page inside the app.
Does my data go to an AI company?
Only when you use a feature that needs one: Copilot, category suggestions, statement scans, receipt reading. Anthropic runs those. One switch per space turns the lot off, and it is not tied to your plan.
Is my data in the EU?
The database is in Amsterdam and the application runs in London. Some providers we depend on, email delivery and crash reporting among them, sit elsewhere; the privacy policy names each one and what it receives.
What happens if I leave?
Take everything first: the export is the whole space as JSON, on demand. Deleting the account erases your files and every sign-in method, and anonymises what has to remain so shared ledgers other people use do not break.
Do you sell any of this?
No. Orla is paid for by subscriptions, which is the only business model that does not put us on the other side of this question.
Check it yourself.
The same facts are on a page inside the app, built from your own account.