FinLens is the consented email-intelligence platform. Users connect their mailbox through a hosted consent flow, FinLens parses their financial emails server-side — statements, policies, folios, subscriptions — and your app receives clean, typed insights through SDKs and APIs. You never touch tokens or raw email.
Integrates in a day with @finlens/web · @finlens/react-native · finlens_flutter · @finlens/node
FinLens carries the entire acquisition and parsing burden — mailbox OAuth verification, annual security assessments, parser maintenance — so integrating apps inherit the capability through a thin SDK.
Your app opens the hosted FinLens Connect flow in the system browser. The user sees exactly what will be read (financial senders only — the list is one tap away), grants mailbox access to FinLens, and separately approves sharing insights with your app specifically.
Hosted flow · PKCE · never a WebViewSender-verified financial emails are ingested and parsed inside an isolated, audited boundary: bank & card statements, password-locked PDFs, eCAS portfolio files, insurance policies, mandates, receipts — normalized into one canonical financial graph per user.
DKIM-authenticated senders onlyThe optimisation engine finds where the user is losing money and returns typed Insight objects — with evidence, severity, and yearly impact — via REST APIs, webhooks, and drop-in UI components. Every insight is explainable: "because 3 charges of ₹590…".
Typed objects · webhooks · UI kitA growing catalog of deterministic, explainable detectors — each one renders to the end user with evidence and rupee impact. Here's a sample of what ships in v1.
Revolving interest and late fees quietly compounding across the user's cards, annualized so the real cost lands.
cc.interest_paidRecurring charges with no usage signal — or duplicate services in the same class, like two streaming plans.
sub.zombieThe same merchant charging steadily more over time — surfaced the moment the pattern forms.
sub.price_creepMinimum-balance penalties, SMS and service fees across every account the user holds — totalled and traced.
bank.chargesActive auto-debit mandates with no matching service emails — money leaving for services the user may have forgotten.
mandate.orphanDuplicate or overlapping covers, premium outliers, and premiums about to lapse with grace-period countdowns.
ins.overlap · ins.lapse_riskA refund promised by email that never posted to any statement — pure fact, and a crowd favourite.
cash.refund_missedExpense-ratio drag on mutual-fund folios computed from the user's own eCAS — the math shown, framed educationally.
mf.regular_vs_directCross-currency and dynamic-conversion markups summed across the user's card spend abroad and online.
cc.forex_markupThe SDK is deliberately thin: open the hosted consent flow safely, stream sync progress, read insights. All intelligence stays server-side — so SDK releases are rare, small, and low-risk.
Web, React Native, Flutter, and a Node backend SDK with HMAC signing built in. Identical API names across platforms — docs translate 1:1. REST for everything else.
SDKs never see mailbox tokens and store nothing durable. Frontends handle a one-shot public token; your backend holds a revocable, partner-scoped grant. That's it.
A synthetic mailbox corpus — statements, eCAS files, premium notices, receipts — replays through the real pipeline. Integrate end-to-end, including webhooks and deletion, before touching a single real mailbox.
A sync event stream lets your UI say "Reading statements… found 3 leaks so far" while backfill runs. First insights typically land within five minutes of consent.
import { FinLens } from "@finlens/web"; const fl = FinLens.init({ env: "sandbox" }); // 1 · Open the hosted consent flow const handler = fl.createConnect({ connectToken, // minted by your backend onSuccess: ({ publicToken }) => sendToBackend(publicToken), onExit: ({ code }) => showRetry(code), onEvent: (e) => track(e), // OPENED, CONSENT_SHOWN, LINKED… }); handler.open(); // 2 · Read insights + stream sync progress const client = fl.client({ clientToken }); const { insights } = await client.insights.list({ state: "new" }); client.sync.subscribe((s) => renderProgress(s));
import { FinLensAdmin } from "@finlens/node"; const fl = new FinLensAdmin({ apiKeyId, apiSecret }); // HMAC built in // 1 · Mint a connect token for your frontend const { connectToken } = await fl.connect.createToken({ endUserRef: "user_8231", products: ["insights"], }); // 2 · Exchange after the user consents const { grantId, personaId } = await fl.connect.exchange({ publicToken }); // 3 · Short-lived, read-only token for your frontend const { clientToken } = await fl.personas.clientToken(personaId);
import { FinLens } from "@finlens/react-native"; const fl = FinLens.init({ env: "sandbox" }); // Chrome Custom Tabs / ASWebAuthenticationSession — // never a WebView, returns via verified app links const handler = fl.createConnect({ connectToken, onSuccess: ({ publicToken }) => api.link(publicToken), onExit: ({ code }) => {}, }); handler.open(); const { insights } = await fl.client({ clientToken }) .insights.list({ state: "new" });
final fl = FinLens.init(env: Env.sandbox); // Same names as the TS SDKs — docs translate 1:1 final handler = fl.createConnect( connectToken: connectToken, onSuccess: (r) => api.link(r.publicToken), onExit: (e) => {}, ); await handler.open(); final insights = await fl .client(clientToken) .insights .list(state: "new");
// Signed, retried, replayable — verify in one line app.post("/finlens/webhooks", (req, res) => { const events = fl.webhooks.verify(req.headers, req.rawBody); for (const e of events) { switch (e.type) { case "insight.created": // new money leak found case "grant.requires_relink": // user revoked at provider case "consent.revoked": // user revoked your app handle(e); } } res.sendStatus(200); });
Two independent consent layers, an immutable ledger of exactly what each user agreed to, and a self-serve portal where they can walk away at any time — no partner app required.
These aren't policies we promise to follow. They're enforced in the architecture — the egress schema has no representation for raw email, so it cannot leak by construction.
No bodies, subjects, sender addresses, or attachments ever reach a partner. Schema-impossible, not policy-discouraged.
No data sales, no advertising, no retargeting. Data flows only to the app the user consented to, for the feature they consented to.
Email-derived data is never used to determine credit-worthiness or routed to lenders. Excluded from the catalog and the contract.
No generalized models are trained on mailbox data. Parsing is deterministic-first; improvements ship as human-authored rules.
FinLens carries the mailbox-platform verification and annual independent security assessment (CASA) once, so every integrating app inherits a compliant capability without touching restricted data.
Mailbox tokens live in an encrypted vault (AES-256-GCM envelope encryption, managed KMS, rotated keys) inside a network-isolated boundary. Raw email is transient — parsed and reaped within 24 hours.
The platform is designed to OWASP ASVS L2 and undergoes Google's CASA security assessment annually as a restricted-scope application. Your app never enters that audit scope.
Immutable consent ledger, one-click withdrawal parity, verified deletion with per-store receipts, breach runbooks, and data-residency in Mumbai (asia-south1) for India-first products.
Only DKIM/SPF-authenticated senders from a curated institution registry are parsed. A spoofed "bank email" in the mailbox never becomes a verified insight.
Every access, egress, and deletion is written to an append-only, hash-chained audit log. Human access to the boundary requires just-in-time approval by a second person, fully recorded.
Scoped keys, per-app rate classes, anomaly detection, response watermarking, and a kill switch per integration — a compromised partner cannot become a platform incident.
Reading customer email is a regulated, audited, quota-bound, parser-heavy capability. FinLens exists so you only build the part your users see.
| Capability | Building in-house | With FinLens |
|---|---|---|
| Restricted-scope verification | ~6-week review, brand assets, demo videos, scope justification — repeated on every scope change | Inherited. FinLens holds the verified app; your scopes never change |
| Annual security assessment (CASA) | Yearly independent audit of every system touching mailbox data, at your cost | Inherited. Your app stays outside the audit boundary |
| Parser fleet | Per-institution templates: statements, locked PDFs, eCAS, policies — breaking silently on every redesign | Maintained for you, with canary alerts and versioned replay on fixes |
| Locked-PDF handling | PAN/DOB password flows, secret custody, OCR for scanned and regional-language documents | Built in — vaulted or ephemeral password modes, user-chosen |
| Quota engineering | Per-user and project-wide API quotas, push-notification renewal, backfill pacing | Managed — first insights in minutes, deep history in the background |
| Consent & deletion machinery | Consent ledger, withdrawal parity, verified erasure, breach notification clocks | Platform-native, with receipts your compliance team can hand to auditors |
| Time to first user insight | Quarters | About a day of integration — sandbox keys to production path included |
consent.revoked webhook and egress for that user stops in under a minute. If the user revokes mailbox access at the provider, you get grant.requires_relink and the SDK ships a re-link flow. Full deletion is orchestrated across every store with per-store receipts — typically complete within 24–72 hours.Sandbox keys, a realistic synthetic mailbox, and docs that get you to your first insight today — no mailbox provider setup, no compliance project.