Yes, all data is transmitted over encrypted channels from the customer and our partners to us with industry-standard encryption. Sensitive fields are identified by our privacy team, and receive additional scrutiny. Teams work with our security team to ensure that all the necessary protections are in place.

Our Privacy Policy contains the most comprehensive response to this question. However, on a high-level, we generally share your data with your consent, unless we are required by law to do so, or the sharing in question is required for our legitimate business interest or for purposes of enforcing our rights. 

Customers can sign up with their Apple login, Google logins, or username and password saved at NerdWallet. Multi-Factor Authentication (MFA) is required to add a layer of protection to your account, by preventing malicious attackers from taking over your account without your knowledge.

Please contact us immediately

We complete yearly third-party penetration testing, and regularly engage an independent third party to find and remedy any issues. Also, we routinely take steps to look for vulnerabilities in our applications using our internal testing processes.

We enhance our consumer account monitoring with Bot and AI detections, brute force protections, and breached password prevention. Our third party risk monitoring protocol responds to vendor incidents in the same manner we would respond to internal incidents.

We utilize a third-party service that monitors for changes on the platform and targets those changes as they are released. We couple this with our internal penetration testing team and vulnerability disclosure program to further harden our infrastructure.

NerdWallet does not process your credit card payments or transactions. If you suspect something is wrong with your credit card, please reach out to your financial institution immediately.

Employees are required to complete regular security awareness training and engineers are required to complete quarterly security training. Access to customer data is granted in a manner consistent with NerdWallet’s Privacy Policy.

Yes. NerdWallet typically responds to Data Subject Access Requests within the time period provided by law. You can also see our updated Privacy Policy, to find information about how we collect, use, disclose, and otherwise process personal data.

Please reach out to our Customer Support team at [email protected] for help.

You can report it to our vulnerability disclosure program on Hackerone.