Your bank accounts in Excel. Your history sealed to you.
Cellar syncs your banks and brokerages into your own workbook. We store your transaction history encrypted to a key only your devices hold.
No cookies. No tracking scripts.
In your spreadsheet
Excel is the app.
Accounts, balances and transactions land in sheets you own. Sort, chart and write formulas the way you already do. First release: Excel on the web and Excel for Windows.
Your bank login
You sign in at your bank.
Cellar connects through a bank-owned data network. We never receive your bank username or password.
Privacy
Stored sealed. We can't open it.
Your browser makes a key that stays on your devices. Every transaction is sealed to that key before we store it, so a stolen database, our cloud provider or a subpoena gets no readable transaction history from what we store.
What is sealed
Transaction amounts, dates, descriptions, merchants and notes. Balances and account names. Your categories, rules and holdings.
Who can't read it
We can't. Neither can a thief with our database, our cloud provider, or a subpoena for what we store.
What we can see
- Which banks you connected, and whether each is healthy.
- How many accounts you have, and when each sync ran.
- How many users the account has, when you last signed in and how many sessions are active.
- Activity volume: how many transactions each account holds.
- Bookkeeping fields stored beside each sealed record, such as ids, status and timestamps.
- Your email address, which is stored unencrypted.
We never see amounts, merchants or balances in our tools.
Where that stops
- During a sync, our servers see new transactions usually for seconds, and so could our cloud provider. Our servers also hold your bank's access token, which can fetch your history again until you disconnect.
- We serve the app, so someone who took over our servers, or compelled us, could ship code that reads your key.
- Your workbook is plain Excel. If it lives in OneDrive, Microsoft can read it.
- The encryption isn't quantum-resistant yet.
The full claim and its limits
Your stored transaction history is sealed to a key that only your devices hold. Cellar's servers store it and send it back to you, but they cannot open it. Neither can someone who steals our database or backups, our cloud provider, or someone who compels us to hand over what we've stored.
That's not end-to-end encryption, and we don't call it that. Four things stay true:
- 1. New data, and the bank token. To sync with your bank, our servers fetch your new transactions and hold them in memory while the sync runs, usually for seconds, before sealing them to your key. They also hold the token that lets them fetch from your bank. So someone who took over our servers, or compelled us, could capture new transactions as they arrive, and could use that token to download again whatever your bank still provides, up to two years of history, depending on your bank. Disconnecting your bank revokes the token and closes both.
- 2. The app we serve. The web app and the Excel add-in are served by Cellar. After its first fill, a workbook fills automatically unless you turn that off: the add-in then loads every time you open that workbook, without a click. Once the add-in has opened your key, it keeps it in memory for as long as the workbook stays open. Someone who took over our servers, or compelled us, could ship a modified version that reads your key the next time it loads, and that exposes what's already stored. The Excel add-in also runs Microsoft's Office.js, a script Microsoft can change at any time, in the same page as your key, so the same is true of Microsoft. A client that doesn't load its code from us or from Microsoft would avoid this. Cellar doesn't offer one yet.
- 3. Your spreadsheet is yours. Data you pull into Excel is unencrypted in that file. If it's a OneDrive workbook, Microsoft can read it.
- 4. Not quantum-resistant yet. The key exchange (X25519) is not post-quantum. Someone who copies the sealed data today could open it if a large enough quantum computer is ever built. We'll move to a post-quantum format once audited implementations are available.
Cellar will run on AWS. Amazon will see only sealed data at rest, but it operates the machines where sync happens, so point 1 applies to Amazon too.
Reporting a security issue
Email [email protected]. We acknowledge within 72 hours. We have no bug bounty yet.
Today
Where Cellar is today
Pre-launch. We test on bank sandbox data and hold no real financial data. Cellar will be paid, with no ads and no data sales. We'll publish the security design and the sealing code before we open.
- Can you recover my data if I lose everything?
- No. Without one of your devices or your 12-word recovery code, nobody can open your stored history, us included.
- When does it open?
- When it's ready. We'll email you once.
Get one email when Cellar opens.
That's the only email we'll send.
Privacy notice
Effective 2026-11-10.
The waitlist form collects your email address, and your spreadsheet answer if you give one. Web3Forms emails them to us and deletes its copy after 7 days, under its privacy policy. We keep them in our inbox to write to you once when Cellar opens, and to count the answers. No newsletter, no sharing, no sale.
This site sets no cookies, runs no tracking scripts, and loads no fonts or scripts from other companies. Cloudflare hosts it and receives your IP address and browser details to deliver the page, under its privacy policy. We haven't turned on Cloudflare's Web Analytics. We look at the total daily visit count Cloudflare shows every site owner. It isn't linked to you, and we've added no analytics script.
Mail to our domain is forwarded by Cloudflare Email Routing to a mailbox at Gmail, which stores it. To have your email deleted, write to [email protected] and we will.