We would rather show you than say "trust us". Below: what happens when you connect a bank, who runs what, what we do in our code and what is checked on every change.
The short answer: your bank password stays with your bank, and ClassKasa can only read the account. It cannot move money.
Everything on this page is something we can point to. If we have not tested it yet, we do not say it.
When you connect a bank
Only the class treasurer connects a class account, and it is a Premium feature. Parents never log in to a bank through ClassKasa.
1
Your bank password stays with your bank
You log in on your bank's own page, reached through Enable Banking. ClassKasa never sees or stores your bank login or password.
2
Enable Banking Oy fetches the data
Enable Banking Oy is an account information service provider registered with the Finnish Financial Supervisory Authority (FIN-FSA). It asks your bank for the data you allow and passes it to ClassKasa.
3
What we read: account, balance, transactions
The account name, currency and number, the balance, and the transactions (amount, date, sender and title). It is read-only: nothing here can start a payment or move money.
4
For how long: up to 90 days
We ask your bank for 90 days of access, and your bank may set a shorter limit. We look at the account up to four times a day. When the access is about to run out, ClassKasa tells you so you can reconnect.
5
Unplug anytime
Tap "Disconnect the bank" at the bottom of the Bank screen. ClassKasa stops reading and asks Enable Banking to end the session. Banks usually also list the access you have given in online banking, where you can remove it. Transfers already imported stay with the class until the treasurer deletes the bank history.
ClassKasa is built on a few well-known providers. Below is what each one says about itself on its own pages. These are their statements, not ours.
1
Enable Banking (bank connection)
Says on its site that it is a registered account information service provider regulated by FIN-FSA. We found no public list of certificates there, so we claim none for it.
These certificates belong to our providers. ClassKasa itself holds no ISO or SOC certificate.
What we do in our own code
1
Every endpoint has a written rule
Each endpoint that sends or receives data has an entry in a permission table, and the code checks it on every request. Our build fails when a new endpoint arrives without an entry.
2
Other classes do not exist for you
If you ask for something that belongs to another class, you get "not found", the same answer as for something that is not there. Automated tests try this on purpose.
3
No card numbers on our side
Card payments go through Stripe. ClassKasa never stores card numbers.
4
Bank access can only look
We only ask your bank to show us the account, never to make a payment. Money cannot be moved through ClassKasa.
5
HTTPS only, plus browser rules
ClassKasa tells browsers to always use HTTPS and to refuse being shown inside other sites' frames.
What is checked on every change
These automated checks run on every change to the app's code. Each one blocks the build when it finds a new problem.
1
An authorized pentest, and a re-attack
In May 2026 (releases v3.27.0 and v3.27.1, both 2026-05-29) the owner ran an authorized pentest of ClassKasa with Claude Code and the open-source pentest-ai-agents toolkit. It led to 8 fixes, 3 of them rated High. Afterwards every attack was run again: the fixes held, and 3 more places with the same kind of bug were found and closed, each with an automated test that failed first and passes now.
Looks for risky code patterns. A serious finding blocks the build.
4
Library checks
npm audit blocks the build on critical vulnerabilities in the libraries we use, and OSV-Scanner blocks it on new known vulnerabilities.
5
Dependency updates
Every week Dependabot opens grouped pull requests with the dependency updates it found. Patch updates and security updates merge automatically once the required checks pass; major updates always wait for a person. A weekly routine consolidates what is still open into one pull request and works on it until every blocking check passes.
6
Secret scanning
Gitleaks checks the full history of every pull request for passwords and keys that should not be there, and TruffleHog checks it for live, verified secrets. A hit blocks the build.
7
Cross-tenant tests
49 automated test files try to read and change other classes' data. They must be told no.
None of this is a certificate. Apart from the pentest above, these are automated checks.
Found something? Tell us
Write to tomek@classkasa.com. A short note with the steps to reproduce is plenty. Please do not test against other people's classes. Our contact also sits in a machine-readable file, security.txt.