Open Banking Finance Tracking: How IterArc Connects to Your Revolut Securely

Why Your Finance App Should Never Ask for Your Password

Traditional budget trackers have a dirty secret: most of them rely on screen scraping. They ask for your bank login credentials, then simulate a browser session to download your transactions. This approach breaks whenever the bank changes its interface, exposes your credentials to a third party, and violates the terms of service of nearly every European bank.

Key Takeaways

PSD2 Open Banking is an EU regulation that gives you the legal right to share your bank data with authorized apps — without sharing your password

IterArc uses EnableBanking as its licensed connection provider, supporting Revolut and 2,500+ European banks

The connection is read-only — no app can move money or modify your account

Transactions are auto-categorized using a two-tier system: rule-based pattern matching first, AI fallback second

All transaction data is stored offline-first on your device, so your spending history works without internet

Finance tracking integrates directly with IterArc’s habit and food tracking for a unified daily picture

What Is PSD2 Open Banking?

PSD2 (Payment Services Directive 2) is an EU regulation that fundamentally changed how banks share data. Enacted in 2018 and fully enforced across the European Economic Area, PSD2 requires banks to provide secure APIs that let you — the account holder — authorize third-party apps to access your financial data.

Here is how it differs from the old approach:

Aspect	Screen Scraping (Old)	PSD2 Open Banking (New)
Your credentials	Shared with the app	Never leave the bank
Authorization	App logs in as you	You authorize via the bank’s own UI
Data access	Whatever the scraper can grab	Defined, limited scope (accounts, transactions)
Write access	Technically possible	Read-only for AISP providers
Regulatory backing	None (often violates ToS)	EU law, supervised by financial regulators
Connection stability	Breaks when bank UI changes	Stable API maintained by the bank
Revocation	Change your password	Revoke in your bank’s settings or the app

The key acronym is AISP — Account Information Service Provider. This is the regulated category that IterArc’s connection partner, EnableBanking, holds. An AISP can read account balances and transaction history. It cannot initiate payments, transfer funds, or modify anything on your account.

Important: PSD2 is not a voluntary standard. It is law. Banks are legally required to provide these APIs, and any company accessing them must be licensed and supervised by a national financial authority.

How IterArc Connects to Your Revolut

The connection flow takes about 90 seconds, and you never type your bank password into IterArc. Here is exactly what happens:

You tap “Connect bank” in IterArc’s Finance tab. The app opens a secure browser window directed to Revolut’s own authorization page.
You log in to Revolut directly. This happens on Revolut’s domain — IterArc never sees these credentials. Revolut authenticates you using your existing login method (PIN, biometrics, or password).
Revolut asks for your consent. A clear screen shows exactly what data IterArc is requesting: account balance and transaction history. You confirm.
Revolut issues a token. This token is sent back to IterArc through EnableBanking. It grants read-only access to the data you approved, for a maximum of 90 days (PSD2 requirement). After 90 days, you re-authorize with a single tap.
IterArc imports your transactions. The initial sync pulls up to 12 months of transaction history. After that, new transactions sync automatically every time you open the app, and on a background schedule.

No credentials are stored. No passwords are transmitted. The token is encrypted at rest on your device and is usable only through EnableBanking’s licensed infrastructure.

Pro tip: You can revoke IterArc’s access at any time from Revolut’s own settings under “Connected apps.” The revocation is instant and permanent until you re-authorize.

What Data Is Accessed — and What Is Not

Transparency matters. Here is the complete list of data IterArc reads from your Revolut account:

Data Accessed	Purpose
Transaction amount	Budget tracking, category totals
Transaction date and time	Daily/weekly/monthly views, trend analysis
Merchant name	Auto-categorization, pattern matching
Transaction reference	Additional context for categorization
Account balance	Current balance display
Account currency	Multi-currency support

What IterArc does NOT access:

Your bank login credentials
Card numbers or CVV
Standing orders or direct debits setup
Contact lists or beneficiary details
The ability to make payments or transfers

All imported data is stored locally on your device first, then synced to your encrypted Supabase backend. This offline-first architecture means your full spending history is available even when your phone has no internet connection — on the subway, on a plane, or in a mobile dead zone.

Auto-Categorization: Rules First, AI Second

Every transaction that arrives gets categorized automatically using a two-tier system. This is not a simple keyword match — it is a layered approach designed for accuracy and speed.

Tier 1: Rule-Based Pattern Matching

The first pass uses deterministic rules. These are fast, free (no AI calls), and predictable:

Merchant patterns — “LIDL”, “SPAR”, “ALDI” map to Groceries. “NETFLIX”, “SPOTIFY” map to Subscriptions. “BKK”, “BUDAPEST GO” map to Transport.
User-created rules — When you manually correct a categorization, IterArc creates a persistent rule. Correct “ETTEREM XY” to “Dining Out” once, and every future transaction from that merchant is categorized correctly without AI.
Amount-based heuristics — Recurring transactions of the same amount from the same merchant are flagged as likely subscriptions.

Tier 2: AI Fallback

When no rule matches, the transaction is sent to Claude for classification. The AI considers:

Merchant name semantics (even misspelled or abbreviated names)
Transaction amount (a 15,000 HUF charge at an unknown merchant is more likely dining than a subscription)
Time of day patterns (morning transactions at unknown merchants are more likely coffee shops)
Your existing category distribution

The AI assigns a category and a confidence score. High-confidence results are applied silently. Low-confidence results are surfaced for your review, and your correction creates a new Tier 1 rule.

For a deep dive into how this system works and improves over time, see our guide on AI transaction categorization.

Pro tip: The more you correct early on, the fewer AI calls are needed later. Most users find that after 2-3 weeks, over 90% of their transactions are categorized by rules alone — no AI needed.

Monthly Budgets with Smart Notifications

Setting a budget takes 30 seconds. Sticking to it gets easier because IterArc warns you before you overspend, not after. The budgeting system is built around categories:

Budget Example	Monthly Limit	Alert Threshold
Groceries	120,000 HUF	80% (96,000 HUF)
Dining Out	40,000 HUF	75% (30,000 HUF)
Transport	25,000 HUF	90% (22,500 HUF)
Subscriptions	15,000 HUF	100% (at limit)
Entertainment	30,000 HUF	80% (24,000 HUF)

You set the monthly limit and the alert threshold percentage. When your spending in a category crosses the threshold, you get a push notification. The notification is short and actionable — not a guilt trip, just a factual heads-up.

Budget rollover is not supported in v1. Each month starts fresh. This is intentional — rollover budgets add complexity that obscures the simple question: “Am I spending what I planned to spend this month?”

Savings Goals

Beyond category budgets, you can set savings goals with target amounts and deadlines. IterArc calculates the required monthly savings rate and tracks your progress. If your spending pace in a given month threatens your savings goal, you get a notification with the specific amount you need to save by month-end to stay on track.

The Offline-First Advantage

Your financial data should be available when you need it, not when your phone has signal. IterArc’s offline-first architecture means:

Full transaction history is stored in the local SQLite database on your device
Category assignments work offline — Tier 1 rules run locally
Budget calculations are computed from local data
Manual corrections are queued and synced when connectivity returns

This is the same sync architecture that powers IterArc’s habit tracking and food tracking. One sync queue, one conflict resolution strategy, one offline experience across all features.

Important: AI categorization (Tier 2) requires internet. Transactions that arrive offline and do not match any rule are marked “Uncategorized” and automatically re-processed when connectivity returns.

How Finance Integrates with Habits and Food Tracking

IterArc is not a standalone finance app — it is a life-tracking system where finance is one lens among several. The finance module connects to your other tracked data in specific, useful ways:

Food Spending Correlation

When you log a food entry via photo and also have a grocery or dining transaction on the same day, IterArc can surface insights like:

Weekly grocery spend vs. nutrition quality — Are you spending more when you eat better, or is that a myth for your specific pattern?
Dining out frequency vs. calorie targets — How often do restaurant meals push you over your daily calorie goal?

Habit-Linked Spending

Some habits have a financial dimension. A gym membership, a subscription to a meditation app, regular supplement purchases. By seeing your spending categories alongside your habit streaks, you get a clearer picture of which investments in your routine are actually paying off in consistency.

The Daily Summary

The daily briefing — IterArc’s morning and evening snapshot — can incorporate a finance line item. Your evening wrap might show: “Spent 4,200 HUF today across 3 transactions. Groceries budget at 67% with 12 days left.” This is deterministic, generated from local data, with no AI calls.

Security and Privacy Summary

Here is the full security picture in one place:

Layer	Protection
Bank connection	PSD2 AISP via EnableBanking (EU-regulated)
Credentials	Never leave the bank’s domain
Access scope	Read-only (balances + transactions)
Token storage	Encrypted at rest on device
Token lifetime	90 days maximum, then re-authorization required
Data storage	Offline-first (local SQLite), encrypted Supabase backend
Revocation	Instant, via Revolut settings or IterArc
AI processing	Transaction metadata only — no account numbers, no card details

No financial data is sold, shared with advertisers, or used for any purpose beyond showing you your own spending. There is no business model here that depends on your financial data — IterArc is a personal tool, not a fintech platform.

Getting Started

Connecting your Revolut takes under two minutes:

Open IterArc and navigate to the Finance tab
Tap “Connect bank”
Select Revolut from the bank list (or search for it)
Authorize on Revolut’s page
Wait for the initial sync (typically 30-60 seconds for a full year of transactions)
Review the auto-categorized transactions and correct any that need it
Set up your monthly budgets

Your first week is a calibration period. Correct categories aggressively — each correction teaches the system. By week two, you should be reviewing only a handful of transactions per day, and by week three, most categorization happens without any input from you.

For details on how the AI categorization improves over time, see AI Transaction Categorization: How Your App Learns Where You Spend. If you are reading this in Hungarian, check out the Revolut penzugyi kovetes guide for localized examples and merchant patterns.

Summary

IterArc’s finance tracking is built on PSD2 Open Banking — the EU-regulated, password-free, read-only way to connect to your bank. Revolut is supported through EnableBanking, with 2,500+ additional European banks available. Transactions are auto-categorized using deterministic rules first and AI second, with every user correction feeding back into the rule engine. Monthly budgets with smart threshold alerts help you stay on track without constant checking. Everything is offline-first, everything is private, and everything ties back into your daily habits and nutrition tracking for a single, unified picture of your day.