Security
Two-factor, passkeys, biometric unlock, and what to do when you are locked out.
Updated
Two-Factor Authentication
Two-factor authentication adds a second step beyond your password: signing in needs a one-time code from an authenticator app on your phone.
- Go to Settings → Security.
- Find the Authenticator App row and tap Setup.
- Scan the QR code with your authenticator app - Google Authenticator, Authy, 1Password or similar.
- Enter the six-digit code from the app to confirm.
Save your recovery codes somewhere you can actually reach
You get ten, each usable once. If you lose your authenticator and your codes are only in a note on the same phone, you have lost both. A password manager or a printed copy is the point.
Using a Recovery Code
On the code screen, choose to use a recovery code instead and enter one of your ten.
Signing in with a recovery code turns two-factor authentication off
A recovery code means you have lost your authenticator, so Cadence Money removes the old one rather than leaving you locked out of an account that keeps asking for codes you cannot produce. You will see a notice saying so when you land in the app.
Set 2FA up again from Settings → Security as soon as you are back in. That enrols a fresh authenticator and issues a new set of recovery codes; the old codes stop working.
Recovery-code attempts are limited to three an hour, which is another reason to keep the codes somewhere you can get at them quickly.
Passkeys
Passkeys let you sign in without a password, using your device’s Face ID, Touch ID or screen lock instead. Add one from the Passkeys row under Settings → Security, on the web and in both mobile apps - iOS and Android alike. The row only appears where the device you are holding can actually make one, so if it is missing, that device cannot.
A passkey is tied to your device and cannot be phished or reused, making it both faster and more secure than a password. You can keep your password and authenticator app as backups.
Each device you use gets set up on its own, so adding a passkey on your laptop does not add one on your phone. See Signing In for what to expect across several devices, and for the six-digit code Cadence Money emails you when you first sign up.
Biometric Unlock on Mobile
Separately from signing in, the mobile apps can require Face ID, Touch ID or a fingerprint before handing the app back to you. It is not every time you switch apps: Cadence Money asks again once the app has been in the background for more than thirty minutes, so checking a message and coming straight back resumes without a prompt, while picking the phone up the next morning does not. Turn it on under Settings → Security in the app. See Mobile App.
It is worth enabling even if you stay signed in: it is the difference between someone with your unlocked phone seeing your finances and seeing nothing.
Connected Apps
Connected Apps is the second card in Settings → Security. It lists every AI assistant you have connected to Cadence Money - see Connecting an AI Assistant for what that is and how to set one up. A connected app can read your accounts, transactions, budgets and net worth. It cannot change anything.
Each row gives the app’s own name and when it was last used, or Not used yet. Where Cadence Money holds an expiry for the app’s current access, that date follows on the same line; some apps have none recorded and the line simply ends there. Tap Disconnect and the row asks once more before acting.
Disconnecting is immediate, and it is scoped to that one app: the others stay connected. It does not merely stop the app renewing - the access it is already holding stops working at the same moment. If you want it back later, connect it again from the assistant’s side.
No apps are connected to your account means exactly that. If the list cannot be read, the card says so and offers Try again rather than showing you an empty list - worth knowing, because “nothing connected” is the answer you would act on.
Changing Your Password
- Go to Settings → Security.
- Tap Change Password.
- Enter your current password to verify.
- Enter and confirm your new one.
A new password needs at least 8 characters, with a lowercase letter, an uppercase letter, a number and a symbol. The same rules apply when you sign up and when you reset a forgotten password, and the form ticks each one off as you type. Choose something unique to Cadence Money; a password manager can generate and store it for you.
A password change disconnects your apps and widgets
Changing your password cuts off every connected AI app and every home screen widget on your devices, immediately. That is the point: it is the one move that ends access you did not sanction without you having to know what took it. Reconnect the ones you still want afterwards.
Three other changes have the same effect, because Cadence Money treats any change to how you prove who you are as a reason to reissue everything: turning two-factor authentication on or off, and turning biometric unlock on for a device. If your widgets go blank or an assistant stops answering shortly after you set up Face ID, that is why - reconnect and it stays connected.
If You Forget Your Password
Tap Forgot Password on the sign-in screen and Cadence Money sends a reset link to your registered email. The link expires after a short time.
This works from the mobile apps as well as the web, so a forgotten password is not a reason to go find a computer.
How Your Data Is Protected
- Encryption in transit and at rest.
- Your bank credentials are never stored by Cadence Money. Connections are handled through Plaid, and what Cadence Money holds is a read-only token.
- Cadence Money is online-only and keeps no financial data on your device.
- Your data is never sold, never used to train AI models, and never shared with third parties for advertising.
More on connections in Synced Accounts, and on exports and deletion in Privacy & Data Management.