← Vault Not yet in effect

Consumer Data Right

How open banking will work in Vault, and what it does not do today.

Version 1.0 · Effective 8 September 2026 · Last updated 8 September 2026

1. What the Consumer Data Right is

The Consumer Data Right (CDR) is Australian law that lets you direct your bank to share your own banking data with a business you choose. It is the framework behind “open banking” in Australia. It is regulated by the Australian Competition and Consumer Commission and the Office of the Australian Information Commissioner, and it is built around consent: your bank shares nothing unless you tell it to, and you can tell it to stop at any time.

Its practical benefit for you is that a bank feed does not need your banking password. You authorise the share on your bank’s own website, and Vault never sees your login.

2. Vault’s position — stated precisely

Accreditation is granted by the ACCC to entities that meet requirements for security, insurance, dispute resolution and fitness. We do not hold it. The pathway we intend to use is the CDR representative model, in which an accredited business collects data on our behalf and remains responsible for what we do with it.

Our intended CDR principal is Fiskil, which holds unrestricted accreditation as a data recipient. That arrangement is not signed. Until it is, none of the rest of this page is operative.

3. How the representative model works

Under the CDR Rules, a business that is not itself accredited can provide CDR services through a written CDR representative arrangement with an accredited principal. In that arrangement:

• The principal (Fiskil) is the accredited party. It collects your banking data from your bank and is legally responsible for what the representative does with it.
• The representative (Vault) provides the product you actually use, and must comply with the CDR privacy safeguards as though it were the principal.
• The principal’s CDR policy governs CDR data, not ours. That is a requirement of the rules, not a preference. When the arrangement is live, Fiskil’s CDR policy will apply to your banking data and will be linked from here and from inside the app. Our Privacy Policy continues to cover everything else.
• A representative may not sub-contract the handling of CDR data to another provider.
• Vault would be listed by name in the published register of Fiskil’s CDR representatives, so you can verify the relationship independently rather than taking our word for it.

4. Consent — how it will work

Under the CDR Rules, consent must be voluntary, express, informed and specific, and it is time-limited. In practice, when you connect a bank feed:

• You will be told, before anything is requested, what data is being asked for and what it will be used for — categorising your spending, tracking balances, and preparing your own tax figures.
• You will be asked for separate consents: for the accredited principal to collect the data from your bank, and for it to be used to provide the service you asked for.
• You will authorise the share on your bank’s own website. Vault does not see, and cannot see, your banking credentials.
• Consent lasts for a period you choose, up to a maximum of 12 months, and then expires unless you renew it. It does not roll on silently.
• You choose which accounts to include and how much history to import. Untick anything you do not want in Vault.
• Consent is never a condition of using Vault. Declining costs you a convenience, nothing more.

5. What data would be collected, and where it goes

Account details (name, type, masked number, balance, institution) and transactions (date, amount, description, status) for the accounts you select.

The route matters, so here it is exactly:

• Your bank sends the data to the accredited principal.
• Our server relays it through to your device, where it is stored in your local vault.
• We do not store your bank transactions on our servers. Our server function passes them through; it does not keep them. What is recorded server-side is that an enrolment exists and when the feed last fired — no amounts, no descriptions, no account numbers.
• If you also use cloud sync, the transactions are encrypted on your device before upload, exactly like everything else. We cannot read them.
• Bank-sourced transaction descriptions are withheld from any off-device AI model. Vault’s categoriser will not send them, and this is enforced in code and tested against what is actually transmitted. A model running on your own machine is not affected, because nothing leaves it.

Your data is not sold, brokered, used for advertising or used to train AI models. Our server-side hosting is in Australia.

One feature to be aware of: the optional AI QuickView sends summary totals for a financial year to an AI provider you configure, and those totals are calculated over bank-fed transactions among others. It is off unless you enable it with your own API key, and the app asks you to confirm before the first send. See the Privacy Policy.

6. Withdrawing consent

You can withdraw at any time, from any of three places, and any one of them is enough:

• In Vault, by removing the bank connection.
• On the accredited principal’s consumer dashboard.
• On your own bank’s online banking, which lists every data sharing arrangement you have authorised.

Withdrawal stops future data sharing immediately. It does not need a reason and there is no penalty.

Transactions already delivered stay in your ledger. This is deliberate: they are your financial records and may be tax substantiation, and silently deleting five years of history because you disconnected a feed would be the wrong default. You can delete them yourself at any time, in the app, individually or in bulk.

7. Deletion and de-identification

Under the CDR Rules, when consent is withdrawn or expires and the data is no longer needed, it must be deleted or de-identified. Because Vault does not retain CDR data server-side, there is very little on our side to delete — the enrolment record and the feed timestamps, which go when you remove the connection or delete your account.

The copy that matters is the one on your own device, and you control it directly. Vault does not de-identify your data for research or any other purpose, and does not disclose de-identified data to anyone.

To have your account and all server-side data deleted, email [email protected] — see the Privacy Policy for that process and our 30-day commitment.

8. Complaints

Start with us: [email protected]. We acknowledge within 7 days and answer substantively within 30.

Once the CDR arrangement is live, a complaint about CDR data can also go to the accredited principal, whose internal dispute resolution process and external scheme membership will be published here alongside its CDR policy. From there, the external paths are:

• The Australian Financial Complaints Authority (AFCA) — afca.org.au, 1800 931 678.
• The Office of the Australian Information Commissioner (OAIC) for privacy matters — oaic.gov.au, 1300 363 992.

General information about your rights is at cdr.gov.au.

9. What works right now instead

Bank feeds are a convenience, not a requirement. Today, without any of the above:

• CSV import works with every Australian bank. Download a statement, drop it in, and Vault detects the column layout and shows you the mapping before it commits anything.
• Up Bank connects directly with a free personal access token you generate yourself. This is not a CDR feed — it is Up’s own API, and the token stays on your computer.
• Manual entry works offline, forever, on the free plan.

Every one of these puts the same data in the same ledger, and the tax engine does not care which one it came from.