Forbidden Finance · Comparison
Forbidden Finance vs Zerosum
Zerosum is a zero-based budgeting app launched in February 2026 by solo developer Pedro Fidalgo, positioned explicitly as a cheaper YNAB alternative with one-click YNAB and Actual Budget import. Bank sync (Pro plan) runs on Plaid in the US/Canada and an open-banking rail elsewhere.
Zerosum is best for: Strict zero-based budgeters who want the cheapest bank-synced option and are comfortable with a young product.
Facts about Zerosum were checked against their published pages in August 2026; every cell links its source. Spot something out of date? Tell us at support@403fin.io and we'll fix it.
At a glance
| Dimension | Forbidden Finance | Zerosum |
|---|---|---|
| The basics | ||
| Price | Free tier forever; paid plans $4.99–$14.99/mo. No free trial — 30-day money-back guarantee on web purchases. | Basic $30/yr (manual); Pro $75/yr — or $9/mo billed monthly — with bank sync, billed via the web. Free trial offered.↗ |
| Business model | Subscriptions only. No ads, no data sales, no cross-sells. | Solo-developer indie subscription app; closed source; no outside funding disclosed.↗ |
| Security & privacy | ||
| Data selling & ads | We never sell user data, share it with advertisers, or build behavioral profiles for third parties. | States it never sells personal or financial data; describes anonymous cookieless page-view analytics on marketing pages only, with nothing tracked inside the app.↗ |
| Bank credentials & tokens | Bank credentials never touch our servers (entered with regulated aggregators); sensitive tokens encrypted with AES-256-GCM before storage. | States TLS in transit, encryption at rest including backups, bank usernames/passwords never stored (Plaid-hosted portal), and an extra encryption layer on bank connection keys.↗ |
| Encryption inside the database | Sensitive financial fields are sealed under encryption keys unique to each account before they reach the database; keys live in a separate key service. Amounts are aggregated in memory after decryption, so financial values never need to sit readable in the database. | At-rest encryption (database + backups) with an extra application-level layer on bank credentials only — the developer publicly states amounts and balances are not encrypted at the column level.↗ |
| Database-level isolation | PostgreSQL row-level security enforces per-account isolation inside the database engine itself. | Not publicly documented (as of 2026-08).↗ |
| Deletion & export | Self-serve: 30-day recovery window, then permanent deletion and destruction of the account’s encryption keys. Full data export on every tier. | Data export offered; import is strong (CSV/OFX/QFX/QIF + full YNAB/Actual importers). Deletion workflow and retention window not publicly documented (as of 2026-08).↗ |
| Sign-in security | Passkeys, authenticator-app (TOTP) MFA, biometric unlock, session management. | MFA/passkeys: not publicly documented (as of 2026-08).↗ |
| Security testing & audits | Built by a founder with a professional penetration-testing background; an independent, human-led penetration test is scheduled ahead of full launch. Not yet SOC 2 certified — we say so plainly. | No dedicated security team (developer’s public statement); no audit or penetration test documented (as of 2026-08).↗ |
| Features | ||
| Bank sync | US & Canada via regulated aggregators (daily + updates when your bank reports changes); UK/EU via bring-your-own open-banking connections; CSV & JSON import. | Pro only — Plaid in the US/Canada; elsewhere via Lunch Flow (up to 4 connections). Sync frequency not documented.↗ |
| Budget methods | All 8 methods: 50/30/20, Pay Yourself First, Zero-Based, Envelope, Kakeibo, FIRE, Values-Based, Custom. | One method, done deliberately: strict zero-based budgeting with auto-budget actions, carryover, a dozen-plus built-in reports, and custom dashboards from in-app widgets.↗ |
| Investment tracking | Brokerage connections with holdings, activity & cost basis (Pro+); per-lot detail and tax-lot CSV export (Premium). | Balance-level tracking accounts for investments and property; no holdings or cost-basis detail documented.↗ |
| Multi-currency | 1 / 3 / 10 / unlimited currencies by tier, with exchange-rate conversion. | One currency per budget, no automatic conversion — separate budgets per currency.↗ |
| Partner / household | 1 partner (Pro) or up to 5 users (Premium). You choose exactly which accounts to share; partners work in a shared budget while each also keeps a private budget; connection slots can be lent. | 1 shared seat on Basic; 5 seats across all budgets on Pro.↗ |
| Platforms | Web (installable PWA), iOS, Android. Android direct download available today; app-store listings Coming Soon. | iOS App Store app — a web-app wrapper per its own feedback board, where the developer confirmed system integrations like Siri Shortcuts aren’t possible. Installable web app on Android, Mac, and Windows.↗ |
| Open source / self-host | Proprietary, not self-hostable. The exit stays open: full data export on every tier. | Closed source; no self-host, no public API documented.↗ |
Security, side by side
We compare only what Zerosum publicly documents. "Not publicly documented" means exactly that — it is not an accusation, and plenty of solid engineering never makes it to a marketing page. Here's what each side is willing to put in writing.
What Forbidden Finance puts in writing
- Data selling & ads: We never sell user data, share it with advertisers, or build behavioral profiles for third parties.
- Bank credentials & tokens: Bank credentials never touch our servers (entered with regulated aggregators); sensitive tokens encrypted with AES-256-GCM before storage.
- Encryption inside the database: Sensitive financial fields are sealed under encryption keys unique to each account before they reach the database; keys live in a separate key service. Amounts are aggregated in memory after decryption, so financial values never need to sit readable in the database.
- Database-level isolation: PostgreSQL row-level security enforces per-account isolation inside the database engine itself.
- Deletion & export: Self-serve: 30-day recovery window, then permanent deletion and destruction of the account’s encryption keys. Full data export on every tier.
- Sign-in security: Passkeys, authenticator-app (TOTP) MFA, biometric unlock, session management.
- Security testing & audits: Built by a founder with a professional penetration-testing background; an independent, human-led penetration test is scheduled ahead of full launch. Not yet SOC 2 certified — we say so plainly.
The full story, including what we're NOT certified for, is on the Security & Privacy page.
What Zerosum documents
- Data selling & ads: States it never sells personal or financial data; describes anonymous cookieless page-view analytics on marketing pages only, with nothing tracked inside the app.↗
- Bank credentials & tokens: States TLS in transit, encryption at rest including backups, bank usernames/passwords never stored (Plaid-hosted portal), and an extra encryption layer on bank connection keys.↗
- Encryption inside the database: Developer’s public Reddit reply (2026-08): "What you cannot do, in any budgeting app, is encrypt the actual amounts and balances at the column level, because then the database can’t sum, filter or aggregate them… Nobody builds budgeting software that way." He also notes he sometimes runs production queries to reproduce bugs (described as mostly aggregate queries).↗
- Database-level isolation: Not publicly documented (as of 2026-08).↗
- Deletion & export: Data export offered; import is strong (CSV/OFX/QFX/QIF + full YNAB/Actual importers). Deletion workflow and retention window not publicly documented (as of 2026-08).↗
- Sign-in security: MFA/passkeys: not publicly documented (as of 2026-08).↗
- Security testing & audits: From the developer’s public Reddit reply (2026-08): "you’re right that we don’t have a dedicated security team. Almost no solo-built product or early-stage startup does." He invites specific reports to security@zerosum.so.↗
Where Zerosum is a better fit
An honest comparison cuts both ways. If these match what you need,Zerosum is a fine choice — we'd rather you pick the right tool than churn out of the wrong one.
- You want the cheapest serious bank-syncing budget: Pro at $75/yr works out to about $6.25/mo — under any paid Forbidden Finance tier with sync.
- You want strict zero-based budgeting and nothing else: the whole product is built around "Ready to Budget" hitting zero, without paying for methods you won’t use.
- You’re leaving YNAB or Actual: a dedicated importer carries accounts, categories, transactions, transfers, AND monthly budget amounts — smoother than generic CSV.
- You want a free trial before paying anything (21 days per the App Store listing).
- You value a minimal analytics footprint: its stated posture is cookieless page-view stats on marketing pages only, nothing tracked in-app.
Trade-offs to know about Zerosum
- Six months old, solo-built — a short public track record
- Developer states amounts and balances are not encrypted at the column level
- MFA/passkeys and a deletion workflow aren’t publicly documented
- One currency per budget, no conversion; investments are balance-only
- The iOS app is a web-app wrapper (per its feedback board): no Siri Shortcuts, and the iPad app shows the mobile view
Why pick Forbidden Finance over Zerosum
Shipped today
- Financial values are sealed under per-account keys inside the database — Zerosum’s developer states amounts and balances are not column-level encrypted.
- Deleting your account destroys your encryption keys, reaching even backups; Zerosum documents no deletion workflow.
- Passkeys, TOTP MFA, and biometric unlock today — none are documented for Zerosum.
- Multi-currency with conversion and investment holdings with cost basis, versus one currency per budget and balance-only tracking.
- Zero-based is one of our 8 methods, so the method can grow with you.
- Our iOS and Android apps are real compiled apps, not wrapped web views — Zerosum’s developer has confirmed its iOS app can’t support system integrations like Siri Shortcuts.
- 30-day money-back guarantee on web purchases instead of a trial that auto-converts.
On the way
- Flexible budget periods — pick your own start date and frequency, or alternate phases: run a 6-month budget, or three high-income months followed by three lean ones, the way contractor income actually works Coming Soon
- AI-powered insights (privacy-gated, on open models) Coming Soon
- API access Coming Soon
- MCP connector for AI assistants Coming Soon
- Dedicated FIRE planning tools Coming Soon
- Debt payoff tools Coming Soon
Unshipped features stay labeled until they're real — that's the same honesty rule the rest of this page runs on.
Switching from Zerosum?
Export your data from Zerosum, then bring it in with Forbidden Finance's CSV & JSON import — available on every tier, including Free, so you can test-drive with your real data before paying anything. The help docs walk through imports step by step.
Common questions
On the web, Zerosum is $30/year (manual Basic) or $75/year — $9/month billed monthly — with bank sync (Pro); its App Store in-app prices run higher. That undercuts our paid tiers if zero-based budgeting with North-American sync is all you need. Forbidden Finance costs more but adds seven other budget methods, investment holdings with cost basis, multi-currency conversion, and a UK/EU rail on top.
It launched in February 2026 and is built by one developer, Pedro Fidalgo, a seven-year YNAB user — so it is early, with a short public track record, and things like MFA/passkeys and a deletion workflow aren’t publicly documented yet. It states that credentials never touch its servers (Plaid hosts the connection) and data is encrypted at rest including backups; the developer has publicly clarified that amounts and balances are not encrypted at the column level inside the database — which is standard practice for most budgeting apps, and exactly the thing Forbidden Finance’s per-account envelope encryption does differently. Our own app is also young; the honest differences are the encryption model, documentation depth, and team redundancy.
Minimally. It supports many currencies as a budget’s denomination but doesn’t convert between them (separate budgets per currency), and investments are balance-only tracking accounts. Forbidden Finance converts across currencies in one plan and pulls investment holdings with cost basis from Pro.
Zerosum’s documented setup pairs Plaid in the US and Canada with an open-banking rail elsewhere, capped at 4 connections on Pro (its provider lineup has shifted during 2026). Forbidden Finance covers the UK and EU through its bring-your-own open-banking rail, where connected accounts never count against your plan’s limits.
Ready to Take Control?
Join thousands who've stopped guessing and started growing.