Your money, in your spreadsheet, kept to yourself.
Cellar syncs your bank and brokerage accounts into Excel. Every transaction is sealed to a key that only your devices hold, so the history we store is unreadable to us.
No cookies, no analytics, no trackers on this site.
Built for the spreadsheet you already use
Most finance apps want you to live inside their dashboard. Cellar puts your accounts, balances and transactions in your own workbook, and refreshes them when you ask.
- Excel on the web and Excel for Windows first. Mac, Google Sheets and LibreOffice aren't in the first release.
- Live sync with your banks and brokerages, through a bank-owned, API-based data network. You log in on your bank's own site. Cellar never receives your bank username or password.
- Your categories, your rules. No machine learning, nothing sent to an AI vendor, nothing used to train anything.
How it works
- You connect through your bank, not through us. You log in on your bank's own site and approve the connection there. We never see your bank password.
- Your devices make a key we never get. When you set up Cellar, your browser makes a key pair. We store the public half. The private half stays on your devices. We hold only copies of it sealed to your devices and to your recovery code.
- New transactions are sealed as they arrive. Our servers fetch new transactions from your bank, seal each one to your key and store the sealed copy. While a sync runs, usually for seconds, the plaintext is in memory. It is never stored in our database or written to a queue, a cache or a log.
- Your spreadsheet opens them. Excel downloads the sealed records and opens them on your machine with your key.
- You keep a recovery code. You get a 12-word recovery code, shown once. Lose every device and the code, and nobody can open your stored history, including us.
What we're claiming, and what we're not
Your stored transaction history is sealed to a key that only your devices hold. Cellar's servers store it and send it back to you, but they cannot open it. Neither can someone who steals our database or backups, our cloud provider, or someone who compels us to hand over what we've stored.
That's not end-to-end encryption, and we don't call it that. Four things stay true:
- 1. New data, and the bank token. To sync with your bank, our servers fetch your new transactions and hold them in memory while the sync runs, usually for seconds, before sealing them to your key. They also hold the token that lets them fetch from your bank. So someone who took over our servers, or compelled us, could capture new transactions as they arrive, and could use that token to download again whatever your bank still provides, up to two years of history, depending on your bank. Disconnecting your bank revokes the token and closes both.
- 2. The app we serve. The web app and the Excel add-in are served by Cellar. Someone who took over our servers, or compelled us, could ship a modified version that reads your key the next time you open it, and that exposes what's already stored. A client that doesn't load its code from us would avoid this. Cellar doesn't offer one yet.
- 3. Your spreadsheet is yours. Data you pull into Excel is unencrypted in that file. If it's a OneDrive workbook, Microsoft can read it.
- 4. Not quantum-resistant yet. The key exchange (X25519) is not post-quantum. Someone who copies the sealed data today could open it if a large enough quantum computer is ever built. We'll move to a post-quantum format once audited implementations are available.
Cellar will run on AWS. Amazon will see only sealed data at rest, but it operates the machines where sync happens, so point 1 applies to Amazon too.
What we can see
Our operator tools show which banks you've connected, how many accounts of each type, whether syncs succeed, how many transactions each sync added, and when things happened. They don't show amounts, dates, descriptions, merchants, balances or category names. Those are sealed.
Two things that list gives away, said plainly: which banks you use, and roughly how busy your accounts are.
Where Cellar is today
Cellar is pre-launch. We're building and testing it on bank sandbox data. Cellar holds no real financial data today. There's no signup yet, and nothing to buy.
It will be a paid product, with no ads, no data sales and no "partners". Pricing isn't set yet.
Before we open it, we'll publish our security design document and the code that seals and opens your data, so you can check this page against it.
FAQ
- Why should I trust a small company with my bank data?
- You shouldn't have to. Cellar is built so that our servers store your history without a key to open it, and we've written down exactly where that stops being true (above). When we publish the design and code, you'll be able to check it.
- Can you get my history back if I lose everything?
- No. If every device and your recovery code are gone, nobody can open your stored history, including us. You can start again and re-sync what your bank still provides.
- Who's building this?
- An independent team in the United States. We built the tool we wanted and couldn't buy.
- When does it open?
- When it's ready. Join the waitlist and we'll write once when it does.
Get one email when it opens
Leave your email and we'll write once when Cellar opens. That's all we use it for.