Security & regulation
Account aggregation and payment initiation run through an FCA-authorised AISP/PISP partner, under PSD2 and the Payment Services Regulations 2017. Cleo never holds your bank credentials.
Virtual debit cards are issued on a regulated banking-as-a-service platform and provisioned to Apple Pay and Google Pay.
Cleo compares and executes on factual utility, subscription and tariff data you approve. It operates within the non-advised regime and does not give regulated investment advice.
Every switch, cancellation or filing is an action ticket. Nothing happens until you authorise it with biometrics or a one-time code. The conversational assistant only interprets intent; a deterministic rules engine carries out the action.
256-bit AES encryption at rest, TLS 1.3 in transit, strict tenant isolation. Employers offering Cleo as a benefit see aggregate uptake and savings only, never an individual employee's data.
Your mobile number and a text code: one Organic iD across every brand on the Organic stack.