ZurixYour finances are nobody's business.
Zurix is a Swiss bank engineered around two promises: we collect almost nothing about you, and we protect what little we hold with defence in depth. No trackers. No data brokers. No exceptions.
We know as little about you as possible.
Swiss discretion, applied to data. Built in the spirit of the Federal Act on Data Protection (revFADP).
Zero tracking
No analytics, advertising pixels or third-party scripts. Even our fonts are served from our own domain, so your browser never talks to anyone else.
Data minimisation
A name and an e-mail address open an account. We never ask for your phone number, home address or social profiles.
No IP logging
Abuse protection works on a one-way hash of your network address that expires within the hour. The address itself is never written down.
One cookie, no banner
A single strictly necessary session cookie. Nothing to consent to, because there is nothing tracking you.
Export or erase
Download everything we hold about you as a file, or permanently delete your profile, accounts and history in one step.
- Your name
- Your e-mail address
- A one-way hash of your password
- Your accounts and transactions
- IP address or location
- Device fingerprint
- Phone number or home address
- Advertising or analytics IDs
Defence in depth, by default.
Every layer assumes the one before it might fail. Read the full security overview.
Hardened credentials
Passwords are salted and stretched with PBKDF2-SHA256 at 100'000 rounds, plus a secret pepper held outside the database. Add two-factor authentication with any authenticator app.
Brute-force lockout
Five wrong passwords lock an account for 15 minutes. Sign-ins, sign-ups and transfers are rate-limited per network and per client.
Short-lived sessions
256-bit random tokens in an HttpOnly, Secure, SameSite=Strict cookie. Sessions end after 15 idle minutes, and you can sign out every device at once.
Locked-down browser
A strict Content-Security-Policy, HSTS, no framing, no referrer leakage and same-origin checks on every request that changes data.
Ledger integrity
Each transfer is one atomic transaction, and the database itself refuses any balance below zero.
Anti-phishing
We will never ask for your password by e-mail, SMS or phone. Your security log shows every sign-in and change, and discreet mode hides balances on screen in public.
Privacy, by default.
Two minutes, a name and an e-mail address. Nothing more.