diff --git a/CLAUDE.md b/CLAUDE.md
index 03e51eb..4fbfb74 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -126,6 +126,13 @@ assembles all crates.
   `crates/myapps-core/src/i18n/`. App-specific translations live in each app
   crate's `i18n.rs` module. Both use compile-time struct-based translations;
   adding a field forces both EN and ES to be updated.
+- **Escape user-controlled strings before interpolating them into HTML.** Handlers
+  build markup with `format!`, which does no escaping, so any user- or
+  provider-supplied value (account names, label names, transaction descriptions
+  and counterparties) must go through `myapps_core::components::html_escape`
+  first. It escapes both quote characters, so it is safe in element bodies and
+  in quoted attribute values. Note that `<option>` bodies are *not* a safe sink:
+  the browser re-parses entity-decoded text there and will build live elements.
 - All app-specific database tables use the app name as prefix (e.g. `leanfin_accounts`, `mindflow_thoughts`, `voice_to_text_jobs`, `form_input_row_sets`, `notes_notes`, `notes_note_updates`).
 - When adding or removing environment variables, update all four places:
   `.env.example`, `deploy/*.env.example`, the `.env` template in `deploy.sh`
diff --git a/Cargo.lock b/Cargo.lock
index b540a62..fd198c9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -35,13 +35,13 @@ dependencies = [
 
 [[package]]
 name = "aes"
-version = "0.9.2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8eb277bec05f56a0e0591f155a484cbd0f4f07ff2905051a48c72f004f7ed58"
+checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
 dependencies = [
  "cipher 0.5.2",
  "cpubits",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
 ]
 
 [[package]]
@@ -60,16 +60,16 @@ dependencies = [
 
 [[package]]
 name = "aes-gcm"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdf011db2e21ce0d575593d749db5554b47fed37aff429e4dc50bc91ac93a028"
+checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
 dependencies = [
  "aead 0.6.1",
- "aes 0.9.2",
+ "aes 0.9.3",
  "cipher 0.5.2",
  "ctr 0.10.1",
+ "ctutils",
  "ghash 0.6.0",
- "subtle",
 ]
 
 [[package]]
@@ -78,7 +78,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10b6f24a1f796bc46415a1d0d18dc0a8203ccba088acf5def3291c4f61225522"
 dependencies = [
- "aes 0.9.2",
+ "aes 0.9.3",
  "byteorder",
 ]
 
@@ -183,12 +183,6 @@ dependencies = [
  "password-hash",
 ]
 
-[[package]]
-name = "arrayref"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb"
-
 [[package]]
 name = "arrayvec"
 version = "0.7.8"
@@ -226,7 +220,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -394,11 +388,10 @@ dependencies = [
 
 [[package]]
 name = "blake2b_simd"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b79834656f71332577234b50bfc009996f7449e0c056884e6a02492ded0ca2f3"
+checksum = "3560a7b1951efe814fcd721938313adc56753ca39f4b23847d7e9a2402f5dbff"
 dependencies = [
- "arrayref",
  "arrayvec",
  "constant_time_eq",
 ]
@@ -456,9 +449,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.4.2"
+version = "1.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d262e149917187838d5b42777c8253bcb64500067342904e7d429499a6f277e"
+checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -478,12 +471,12 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
  "rand_core 0.10.1",
 ]
 
@@ -553,7 +546,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -652,9 +645,9 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
  "libc",
 ]
@@ -912,7 +905,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -955,9 +948,9 @@ dependencies = [
 
 [[package]]
 name = "ed25519-compact"
-version = "2.3.1"
+version = "2.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c24599140dc39d7a81e4476e7573d41bbc18e07c803900298e522a5fbcfbfb6"
+checksum = "f05391a505666bdf2b5d2626f41b7f0f49052b1e33cceac960eaa818008141da"
 dependencies = [
  "ct-codecs",
  "getrandom 0.4.3",
@@ -965,9 +958,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.17.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 dependencies = [
  "serde",
 ]
@@ -1119,9 +1112,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.10"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b73573e6edcd2af0cdf47bd6cb58f0b3839491263c314eaad1ccf24430e1de"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
 
 [[package]]
 name = "flume"
@@ -1235,7 +1228,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -1480,9 +1473,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
 dependencies = [
  "bytes",
  "futures-core",
@@ -1521,9 +1514,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1605,9 +1598,9 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -1619,9 +1612,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -1632,9 +1625,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -1646,16 +1639,17 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
 [[package]]
 name = "icu_properties"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
+ "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
@@ -1666,15 +1660,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.2.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -1708,9 +1702,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.14.0"
+version = "2.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+checksum = "07aa2048142242915a31d35844fb311e0e53fcca590c3a0a40dcf1b841fa09eb"
 dependencies = [
  "equivalent",
  "hashbrown 0.17.1",
@@ -1831,7 +1825,7 @@ dependencies = [
  "k256",
  "p256",
  "p384",
- "rand 0.8.7",
+ "rand 0.8.8",
  "serde",
  "serde_json",
  "superboring",
@@ -1855,12 +1849,12 @@ dependencies = [
 
 [[package]]
 name = "keccak"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffd9697dc4a9a62e2da93389f34400b77a28f0287711263cabb203b3ccb9c0e4"
+checksum = "d8f198d1db720e4940b5a493201d199d9f24f568f8f746bd13706243a2f71598"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
 ]
 
 [[package]]
@@ -1896,14 +1890,14 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.19"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2026a5056764a10b2bf5d56488cba40da507f5493a6a429340e2004d9ed085fa"
+checksum = "d7955dfc218a8afb29dfeffd540e3a6e96baeb94fe7138228dd7cc6937fbbf96"
 dependencies = [
  "bitflags",
  "libc",
  "plain",
- "redox_syscall 0.9.1",
+ "redox_syscall 0.9.3",
 ]
 
 [[package]]
@@ -1937,9 +1931,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
 
 [[package]]
 name = "lock_api"
@@ -1952,9 +1946,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "lru-slab"
@@ -2066,7 +2060,7 @@ dependencies = [
 
 [[package]]
 name = "myapps"
-version = "0.14.1"
+version = "0.15.0"
 dependencies = [
  "anyhow",
  "axum-test",
@@ -2259,7 +2253,7 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-traits",
- "rand 0.8.7",
+ "rand 0.8.8",
  "smallvec",
  "zeroize",
 ]
@@ -2549,9 +2543,9 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
 [[package]]
 name = "plain"
@@ -2592,15 +2586,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd"
 dependencies = [
  "cpubits",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
  "universal-hash 0.6.1",
 ]
 
 [[package]]
 name = "potential_utf"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
  "zerovec",
 ]
@@ -2670,9 +2664,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.16"
+version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
 dependencies = [
  "bytes",
  "getrandom 0.4.3",
@@ -2727,9 +2721,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -2821,9 +2815,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.9.1"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07507be7b4a5f9f26eeb41eeaebb1f5a7ff29dfb29739facc21d35bf8b11c21e"
+checksum = "d678d17679829e73d371e96880897e98fee2ded7acc0a50bdf8af2affa4b2fe5"
 dependencies = [
  "bitflags",
 ]
@@ -3009,9 +3003,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.14"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -3097,7 +3091,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -3422,7 +3416,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rand 0.8.7",
+ "rand 0.8.8",
  "rsa",
  "serde",
  "sha1",
@@ -3461,7 +3455,7 @@ dependencies = [
  "md-5",
  "memchr",
  "once_cell",
- "rand 0.8.7",
+ "rand 0.8.8",
  "serde",
  "serde_json",
  "sha2",
@@ -3533,14 +3527,14 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c378b1a556adcd6eeb6b56f0ee377763a088843581265f6ec821b232a571b2be"
 dependencies = [
- "aes-gcm 0.11.0",
+ "aes-gcm 0.11.1",
  "aes-keywrap",
  "getrandom 0.2.17",
  "getrandom 0.4.3",
  "hmac-sha256",
  "hmac-sha512",
  "ml-dsa",
- "rand 0.8.7",
+ "rand 0.8.8",
  "rsa",
 ]
 
@@ -3568,9 +3562,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.3"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3646,7 +3640,7 @@ checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -3690,9 +3684,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -3737,7 +3731,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -4025,7 +4019,7 @@ checksum = "f153acc4e99a5f2a5aefa09fb078be54e26271b2813f6041200b224c098d8328"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -4125,9 +4119,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.24.0"
+version = "1.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
+checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -4528,9 +4522,9 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "writeable"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
 [[package]]
 name = "yansi"
@@ -4628,9 +4622,9 @@ checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
 [[package]]
 name = "zerotrie"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -4639,9 +4633,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.6"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -4650,13 +4644,13 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.3"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 8b175d0..9d1b0a2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,7 +29,7 @@ myapps-test-harness = { path = "crates/myapps-test-harness" }
 
 [package]
 name = "myapps"
-version = "0.14.1"
+version = "0.15.0"
 edition.workspace = true
 
 [features]
diff --git a/README.md b/README.md
index c07176c..d34570e 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ login and launcher.
 
 | App | Crate | What it does |
 |-----|-------|-------------|
-| **LeanFin** ($) | [`myapps-leanfin`](crates/myapps-leanfin/) | Personal expense management with bank sync (PSD2 via Enable Banking), manual accounts, labels, auto-labeling rules, balance evolution charts, and expense breakdowns. |
+| **LeanFin** ($) | [`myapps-leanfin`](crates/myapps-leanfin/) | Personal expense management with bank sync (PSD2 via Enable Banking), investment sync (Indexa Capital), manual accounts, labels, auto-labeling rules, balance evolution charts, and expense breakdowns. |
 | **MindFlow** (🧠) | [`myapps-mindflow`](crates/myapps-mindflow/) | Thought capture and mind mapping. Quickly jot down ideas, organise them into categories, visualise connections on a D3-powered map, and turn thoughts into actions. |
 | **VoiceToText** (🎤) | [`myapps-voice-to-text`](crates/myapps-voice-to-text/) | Audio transcription powered by whisper.cpp. Record or upload audio and get text back — all processed locally, no cloud APIs. |
 | **FormInput** (✎) | [`myapps-form-input`](crates/myapps-form-input/) | Custom forms backed by row sets and column-typed inputs. Define form types, manage row sets, and capture spreadsheet-style entries as CSV. |
diff --git a/crates/myapps-core/src/components.rs b/crates/myapps-core/src/components.rs
index 8e8e6d9..5446114 100644
--- a/crates/myapps-core/src/components.rs
+++ b/crates/myapps-core/src/components.rs
@@ -102,9 +102,16 @@ fn render_scalar(value: &serde_json::Value, html: &mut String) {
     }
 }
 
-fn html_escape(s: &str) -> String {
+/// HTML-escape a string for safe interpolation into HTML element bodies or
+/// quoted attribute values. Any user- or provider-controlled string MUST go
+/// through this before reaching a `format!` template.
+///
+/// Both quote characters are escaped, so the result is safe inside `"…"` and
+/// `'…'` attributes as well as in element bodies.
+pub fn html_escape(s: &str) -> String {
     s.replace('&', "&amp;")
         .replace('<', "&lt;")
         .replace('>', "&gt;")
         .replace('"', "&quot;")
+        .replace('\'', "&#39;")
 }
diff --git a/crates/myapps-leanfin/migrations/20260829000000_indexa.sql b/crates/myapps-leanfin/migrations/20260829000000_indexa.sql
new file mode 100644
index 0000000..bdbd0ec
--- /dev/null
+++ b/crates/myapps-leanfin/migrations/20260829000000_indexa.sql
@@ -0,0 +1,8 @@
+-- Indexa Capital provider: per-user API token (AES-256-GCM encrypted, same
+-- scheme as enable_banking_key) and a marker for Indexa-backed accounts.
+--
+-- Indexa accounts reuse leanfin_accounts with account_type = 'indexa':
+--   account_uid          → Indexa account_number
+--   session_expires_at   → 9999-12-31 sentinel (personal tokens do not expire,
+--                          unlike PSD2 consents, so there is nothing to reauth)
+ALTER TABLE leanfin_user_settings ADD COLUMN indexa_token BLOB;
diff --git a/crates/myapps-leanfin/src/accounts.rs b/crates/myapps-leanfin/src/accounts.rs
index 3c41f2d..a940449 100644
--- a/crates/myapps-leanfin/src/accounts.rs
+++ b/crates/myapps-leanfin/src/accounts.rs
@@ -12,6 +12,7 @@ use super::services::enable_banking;
 use super::settings;
 use super::sync_handler::sync_button;
 use myapps_core::auth::UserId;
+use myapps_core::components::html_escape;
 use myapps_core::i18n::Lang;
 use myapps_core::layout::render_page;
 use myapps_core::routes::AppState;
@@ -29,6 +30,10 @@ pub fn routes() -> Router<AppState> {
             "/accounts/manual/new",
             get(manual_new_form).post(manual_new_submit),
         )
+        .route(
+            "/accounts/indexa/link",
+            get(indexa_link_form).post(indexa_link_submit),
+        )
         .route("/accounts/{id}/color", post(update_color))
         .route(
             "/accounts/manual/{id}/edit",
@@ -100,7 +105,7 @@ async fn list_accounts(
     for a in &bank_accounts {
         let session_expires_at = a.session_expires_at;
         let expires = session_expires_at.format("%Y-%m-%d").to_string();
-        let iban = a.iban.as_deref().unwrap_or("\u{2014}");
+        let iban = html_escape(a.iban.as_deref().unwrap_or("\u{2014}"));
         let balance_html = format_balance(a.balance_amount, a.balance_currency.as_deref());
 
         if a.archived {
@@ -121,7 +126,7 @@ async fn list_accounts(
                         </form>
                     </div>
                 </div>"#,
-                bank = a.bank_name,
+                bank = html_escape(&a.bank_name),
                 id = a.id,
                 archived = t.acc_archived,
                 unarchive = t.acc_unarchive,
@@ -178,7 +183,7 @@ async fn list_accounts(
                         </form>
                     </div>
                 </div>"##,
-                bank = a.bank_name,
+                bank = html_escape(&a.bank_name),
                 id = a.id,
                 archive = t.acc_archive,
                 delete = t.acc_delete,
@@ -194,7 +199,7 @@ async fn list_accounts(
     // Manual accounts section
     let mut manual_items = String::new();
     for a in &manual_accounts {
-        let name = a.account_name.as_deref().unwrap_or(&a.bank_name);
+        let name = html_escape(a.account_name.as_deref().unwrap_or(&a.bank_name));
         let balance_html = format_balance(a.balance_amount, a.balance_currency.as_deref());
         let category_badge = match a.asset_category.as_deref() {
             Some(cat) => format!(r#"<span class="category-badge">{cat}</span>"#),
@@ -268,6 +273,84 @@ async fn list_accounts(
         );
     }
 
+    // Indexa accounts: provider-synced like bank accounts, but with no IBAN and
+    // no consent expiry, so they get their own section rather than being
+    // squeezed into the bank list with meaningless columns.
+    let indexa_accounts: Vec<&AccountRow> = accounts
+        .iter()
+        .filter(|a| a.account_type == "indexa" && (show_archived || !a.archived))
+        .collect();
+
+    let mut indexa_items = String::new();
+    for a in &indexa_accounts {
+        let name = html_escape(a.account_name.as_deref().unwrap_or(&a.bank_name));
+        let balance_html = format_balance(a.balance_amount, a.balance_currency.as_deref());
+        let color_val = a.color.as_deref().unwrap_or("#6B6B6B");
+        let archived_badge = if a.archived {
+            format!(r#" <span class="archived-badge">{}</span>"#, t.acc_archived)
+        } else {
+            String::new()
+        };
+        let toggle_btn = if a.archived {
+            format!(
+                r#"<form method="POST" action="{base}/leanfin/accounts/{id}/unarchive" style="display:inline">
+                    <button type="submit" class="btn-icon">{unarchive}</button>
+                </form>"#,
+                id = a.id,
+                unarchive = t.acc_unarchive,
+            )
+        } else {
+            format!(
+                r#"<form method="POST" action="{base}/leanfin/accounts/{id}/archive" style="display:inline">
+                    <button type="submit" class="btn-icon">{archive}</button>
+                </form>"#,
+                id = a.id,
+                archive = t.acc_archive,
+            )
+        };
+        indexa_items.push_str(&format!(
+            r##"<div class="account-item" style="--account-color:{color_val}">
+                <div class="account-color-stripe"></div>
+                <div style="flex:1">
+                    <div class="account-bank">{name}{archived_badge}</div>
+                    <span class="category-badge">{category}</span>
+                    {balance_html}
+                </div>
+                <div class="account-actions">
+                    {toggle_btn}
+                    <form method="POST" action="{base}/leanfin/accounts/{id}/delete"
+                          onsubmit="return confirm('{delete_confirm}')" style="display:inline">
+                        <button type="submit" class="btn-icon btn-icon-danger">{delete}</button>
+                    </form>
+                </div>
+            </div>"##,
+            id = a.id,
+            category = t.acc_cat_investment,
+            delete = t.acc_delete,
+            delete_confirm = t.acc_delete_confirm_manual,
+        ));
+    }
+
+    let has_indexa_token = settings::has_indexa_token(&state.pool, user_id.0).await;
+    let indexa_link_btn = if has_indexa_token {
+        format!(
+            r#"<a href="{base}/leanfin/accounts/indexa/link" class="btn btn-primary">{}</a>"#,
+            t.acc_indexa_link
+        )
+    } else {
+        format!(
+            r#"<a href="{base}/leanfin/settings" class="btn btn-secondary">{}</a>"#,
+            t.acc_indexa_configure
+        )
+    };
+
+    if indexa_items.is_empty() {
+        indexa_items = format!(
+            r#"<div class="empty-state"><p>{}</p></div>"#,
+            t.acc_no_indexa
+        );
+    }
+
     let archived_toggle = if has_archived {
         let checked = if show_archived { " checked" } else { "" };
         format!(
@@ -317,6 +400,15 @@ async fn list_accounts(
                 <div class="account-grid">{bank_items}</div>
             </div>
         </div>
+        <div class="card">
+            <div class="card-header">
+                <h2>{indexa_accounts_heading}</h2>
+                {indexa_link_btn}
+            </div>
+            <div class="card-body">
+                <div class="account-grid">{indexa_items}</div>
+            </div>
+        </div>
         <div class="card">
             <div class="card-header">
                 <h2>{manual_accounts_heading}</h2>
@@ -329,6 +421,7 @@ async fn list_accounts(
         title = t.acc_title,
         subtitle = t.acc_subtitle,
         bank_accounts_heading = t.acc_bank_accounts,
+        indexa_accounts_heading = t.acc_indexa_accounts,
         manual_accounts_heading = t.acc_manual_accounts,
         add_account = t.acc_add,
     );
@@ -543,7 +636,7 @@ async fn manual_edit_form(
         return Redirect::to(&format!("{base}/leanfin/accounts")).into_response();
     };
 
-    let name = account.account_name.as_deref().unwrap_or("");
+    let name = html_escape(account.account_name.as_deref().unwrap_or(""));
     let category = account.asset_category.as_deref().unwrap_or("other");
 
     let cat_labels = [
@@ -662,7 +755,7 @@ async fn manual_value_form(
         return Redirect::to(&format!("{base}/leanfin/accounts")).into_response();
     };
 
-    let name = account.account_name.as_deref().unwrap_or("Account");
+    let name = html_escape(account.account_name.as_deref().unwrap_or("Account"));
     let current = account
         .balance_amount
         .map(|v| format!("{v:.2}"))
@@ -801,7 +894,7 @@ async fn import_csv_form(
         return Redirect::to(&format!("{base}/leanfin/accounts")).into_response();
     };
 
-    let name = account.account_name.as_deref().unwrap_or("Account");
+    let name = html_escape(account.account_name.as_deref().unwrap_or("Account"));
 
     let body = format!(
         r#"<div class="page-header">
@@ -869,7 +962,7 @@ async fn import_csv_submit(
         return Redirect::to(&format!("{base}/leanfin/accounts")).into_response();
     };
 
-    let name = account.account_name.as_deref().unwrap_or("Account");
+    let name = html_escape(account.account_name.as_deref().unwrap_or("Account"));
 
     // Extract file from multipart
     let mut csv_bytes: Option<Vec<u8>> = None;
@@ -880,7 +973,7 @@ async fn import_csv_submit(
                 Err(e) => {
                     return render_import_error(
                         &state.config,
-                        name,
+                        &name,
                         account_id,
                         &format!("Failed to read file: {e}"),
                         lang,
@@ -892,7 +985,7 @@ async fn import_csv_submit(
     }
 
     let Some(csv_bytes) = csv_bytes else {
-        return render_import_error(&state.config, name, account_id, "No file uploaded", lang)
+        return render_import_error(&state.config, &name, account_id, "No file uploaded", lang)
             .into_response();
     };
 
@@ -984,7 +1077,7 @@ async fn import_csv_submit(
             ))
             .into_response()
         }
-        Err(e) => render_import_error(&state.config, name, account_id, &e.to_string(), lang)
+        Err(e) => render_import_error(&state.config, &name, account_id, &e.to_string(), lang)
             .into_response(),
     }
 }
@@ -1027,13 +1120,6 @@ fn render_import_error(
     ))
 }
 
-fn html_escape(s: &str) -> String {
-    s.replace('&', "&amp;")
-        .replace('<', "&lt;")
-        .replace('>', "&gt;")
-        .replace('"', "&quot;")
-}
-
 // ── Link: choose bank ─────────────────────────────────────────────
 
 async fn link_form(
@@ -1431,3 +1517,216 @@ struct PendingLink {
     country: String,
     reauth_account_id: Option<i64>,
 }
+
+// ── Indexa Capital: link accounts ─────────────────────────────────
+
+/// List the Indexa accounts the stored token can read, marking those already
+/// linked. Nothing from `/users/me` beyond account number, type and status is
+/// kept — that response also carries the user's address, email and ID document.
+async fn indexa_link_form(
+    state: axum::extract::State<AppState>,
+    Extension(user_id): Extension<UserId>,
+    Extension(lang): Extension<Lang>,
+) -> impl IntoResponse {
+    let base = &state.config.base_path;
+    let t = super::i18n::t(lang);
+
+    let token = match settings::get_indexa_token(&state.pool, &state.config, user_id.0).await {
+        Ok(tok) => tok,
+        Err(_) => return Redirect::to(&format!("{base}/leanfin/settings")).into_response(),
+    };
+
+    let remote = match super::services::indexa::list_accounts(&token).await {
+        Ok(accounts) => accounts,
+        Err(e) => {
+            tracing::error!("Indexa: failed to list accounts: {e:#}");
+            let body = format!(
+                r#"<div class="page-header"><h1>{title}</h1></div>
+                <div class="card"><div class="card-body">
+                    <div class="alert alert-error">{error}</div>
+                    <a href="{base}/leanfin/accounts" class="btn btn-secondary">{back}</a>
+                </div></div>"#,
+                title = t.acc_indexa_link_title,
+                error = t.acc_indexa_error,
+                back = t.set_back,
+            );
+            return Html(render_page(
+                &format!("LeanFin — {}", t.accounts),
+                &leanfin_nav(base, "accounts", lang),
+                &body,
+                &state.config,
+                lang,
+            ))
+            .into_response();
+        }
+    };
+
+    let linked: Vec<String> = sqlx::query_scalar(
+        "SELECT account_uid FROM leanfin_accounts WHERE user_id = ? AND account_type = 'indexa'",
+    )
+    .bind(user_id.0)
+    .fetch_all(&state.pool)
+    .await
+    .unwrap_or_default();
+
+    let mut rows = String::new();
+    for account in &remote {
+        let already = linked.contains(&account.account_number);
+        let disabled = if already { " disabled checked" } else { "" };
+        let suffix = if already {
+            format!(" — {}", t.acc_indexa_already_linked)
+        } else {
+            String::new()
+        };
+        rows.push_str(&format!(
+            r#"<label class="txn-filter-check" style="display:block; margin:0.5rem 0">
+                <input type="checkbox" name="{prefix}{num}" value="1"{disabled}>
+                {num} ({atype}, {status}){suffix}
+            </label>"#,
+            prefix = INDEXA_CHECKBOX_PREFIX,
+            num = html_escape(&account.account_number),
+            atype = html_escape(&account.account_type),
+            status = html_escape(&account.status),
+        ));
+    }
+
+    if rows.is_empty() {
+        rows = format!(
+            r#"<div class="empty-state"><p>{}</p></div>"#,
+            t.acc_no_indexa
+        );
+    }
+
+    let body = format!(
+        r#"<div class="page-header">
+            <h1>{title}</h1>
+            <p>{subtitle}</p>
+        </div>
+        <div class="card" style="max-width: 32rem;">
+            <div class="card-body">
+                <form method="POST" action="{base}/leanfin/accounts/indexa/link">
+                    {rows}
+                    <div style="display:flex; gap:0.75rem; margin-top:1rem;">
+                        <a href="{base}/leanfin/accounts" class="btn btn-secondary">{cancel}</a>
+                        <button type="submit" style="flex:1">{link}</button>
+                    </div>
+                </form>
+            </div>
+        </div>"#,
+        title = t.acc_indexa_link_title,
+        subtitle = t.acc_indexa_link_subtitle,
+        cancel = t.set_cancel,
+        link = t.acc_indexa_link_submit,
+    );
+
+    Html(render_page(
+        &format!("LeanFin — {}", t.accounts),
+        &leanfin_nav(base, "accounts", lang),
+        &body,
+        &state.config,
+        lang,
+    ))
+    .into_response()
+}
+
+/// Selected accounts arrive as one checkbox per account, named `acct_{number}`.
+///
+/// A repeated `account_numbers` field would be the obvious encoding, but axum's
+/// `Form` uses `serde_urlencoded`, which cannot deserialize repeated keys into a
+/// `Vec`. A flat map sidesteps that without pulling in another extractor.
+#[derive(Deserialize)]
+struct IndexaLinkForm {
+    #[serde(flatten)]
+    fields: std::collections::HashMap<String, String>,
+}
+
+const INDEXA_CHECKBOX_PREFIX: &str = "acct_";
+
+impl IndexaLinkForm {
+    fn selected(&self) -> Vec<&str> {
+        self.fields
+            .keys()
+            .filter_map(|k| k.strip_prefix(INDEXA_CHECKBOX_PREFIX))
+            .collect()
+    }
+}
+
+async fn indexa_link_submit(
+    state: axum::extract::State<AppState>,
+    Extension(user_id): Extension<UserId>,
+    Form(form): Form<IndexaLinkForm>,
+) -> impl IntoResponse {
+    let base = &state.config.base_path;
+
+    let token = match settings::get_indexa_token(&state.pool, &state.config, user_id.0).await {
+        Ok(tok) => tok,
+        Err(_) => return Redirect::to(&format!("{base}/leanfin/settings")).into_response(),
+    };
+
+    // Only accept account numbers the token actually owns — never trust the
+    // form, which could otherwise inject arbitrary values into account_uid.
+    let remote = match super::services::indexa::list_accounts(&token).await {
+        Ok(accounts) => accounts,
+        Err(e) => {
+            tracing::error!("Indexa: failed to list accounts: {e:#}");
+            return Redirect::to(&format!("{base}/leanfin/accounts")).into_response();
+        }
+    };
+
+    let selected = form.selected();
+    for account in &remote {
+        if !selected.contains(&account.account_number.as_str()) {
+            continue;
+        }
+
+        let name = format!("Indexa {}", account.account_number);
+        let currency = account.currency.as_deref().unwrap_or("EUR");
+
+        // Personal API tokens do not expire, so session_expires_at gets the same
+        // far-future sentinel manual accounts use and reauth never applies.
+        let result = sqlx::query(
+            r#"INSERT INTO leanfin_accounts
+               (user_id, bank_name, bank_country, session_id, account_uid, session_expires_at,
+                account_type, account_name, asset_category, balance_currency)
+               VALUES (?, 'Indexa Capital', 'ES', '', ?, '9999-12-31T00:00:00Z',
+                       'indexa', ?, 'investment', ?)
+               ON CONFLICT(account_uid) DO NOTHING"#,
+        )
+        .bind(user_id.0)
+        .bind(&account.account_number)
+        .bind(&name)
+        .bind(currency)
+        .execute(&state.pool)
+        .await;
+
+        match result {
+            Ok(r) if r.rows_affected() > 0 => {
+                let account_id = r.last_insert_rowid();
+                tracing::info!("Linked Indexa account for user {}", user_id.0);
+
+                // Pull the full valuation history so the balance-evolution chart
+                // starts at the account's opening date, not at link time.
+                let row: Option<crate::models::Account> = sqlx::query_as(
+                    "SELECT id, user_id, bank_name, bank_country, iban, session_id, account_uid, session_expires_at, balance_amount, balance_currency, account_type, account_name, asset_category, color, archived, created_at FROM leanfin_accounts WHERE id = ?",
+                )
+                .bind(account_id)
+                .fetch_optional(&state.pool)
+                .await
+                .unwrap_or(None);
+
+                if let Some(row) = row {
+                    match super::services::sync::backfill_indexa_history(&state.pool, &token, &row)
+                        .await
+                    {
+                        Ok(n) => tracing::info!("Indexa: backfilled {n} balance snapshots"),
+                        Err(e) => tracing::warn!("Indexa: history backfill failed: {e:#}"),
+                    }
+                }
+            }
+            Ok(_) => {}
+            Err(e) => tracing::error!("Failed to link Indexa account: {e}"),
+        }
+    }
+
+    Redirect::to(&format!("{base}/leanfin/accounts")).into_response()
+}
diff --git a/crates/myapps-leanfin/src/balance_evolution.rs b/crates/myapps-leanfin/src/balance_evolution.rs
index 5437107..428cf4a 100644
--- a/crates/myapps-leanfin/src/balance_evolution.rs
+++ b/crates/myapps-leanfin/src/balance_evolution.rs
@@ -5,6 +5,7 @@ use serde::Deserialize;
 use super::dashboard::leanfin_nav;
 use super::services::balance::{self, BalancePoint};
 use myapps_core::auth::UserId;
+use myapps_core::components::html_escape;
 use myapps_core::i18n::Lang;
 use myapps_core::layout::render_page;
 use myapps_core::routes::AppState;
@@ -67,7 +68,7 @@ async fn page(
 
     let mut account_options = format!(r#"<option value="">{}</option>"#, t.txn_all_accounts);
     for a in &accounts {
-        let display = if a.account_type == "manual" {
+        let display = if a.account_type != "bank" {
             a.account_name
                 .clone()
                 .unwrap_or_else(|| a.bank_name.clone())
@@ -77,7 +78,11 @@ async fn page(
                 None => a.bank_name.clone(),
             }
         };
-        account_options.push_str(&format!(r#"<option value="{}">{}</option>"#, a.id, display,));
+        account_options.push_str(&format!(
+            r#"<option value="{}">{}</option>"#,
+            a.id,
+            html_escape(&display),
+        ));
     }
 
     let body = format!(
diff --git a/crates/myapps-leanfin/src/dashboard.rs b/crates/myapps-leanfin/src/dashboard.rs
index 19a7b3a..0bb083c 100644
--- a/crates/myapps-leanfin/src/dashboard.rs
+++ b/crates/myapps-leanfin/src/dashboard.rs
@@ -2,6 +2,7 @@ use axum::{Extension, Router, response::Html, routing::get};
 
 use super::sync_handler::sync_button;
 use myapps_core::auth::UserId;
+use myapps_core::components::html_escape;
 use myapps_core::i18n::Lang;
 use myapps_core::layout::{NavItem, render_page};
 use myapps_core::routes::AppState;
@@ -101,7 +102,7 @@ async fn index(
 
     let mut account_options = format!(r#"<option value="">{}</option>"#, t.txn_all_accounts);
     for a in &accounts {
-        let display = if a.account_type == "manual" {
+        let display = if a.account_type != "bank" {
             a.account_name
                 .clone()
                 .unwrap_or_else(|| a.bank_name.clone())
@@ -111,7 +112,11 @@ async fn index(
                 None => a.bank_name.clone(),
             }
         };
-        account_options.push_str(&format!(r#"<option value="{}">{}</option>"#, a.id, display,));
+        account_options.push_str(&format!(
+            r#"<option value="{}">{}</option>"#,
+            a.id,
+            html_escape(&display),
+        ));
     }
 
     let labels: Vec<LabelOption> =
@@ -126,7 +131,11 @@ async fn index(
 
     let mut label_options = format!(r#"<option value="">{}</option>"#, t.txn_all_labels);
     for l in &labels {
-        label_options.push_str(&format!(r#"<option value="{}">{}</option>"#, l.id, l.name,));
+        label_options.push_str(&format!(
+            r#"<option value="{}">{}</option>"#,
+            l.id,
+            html_escape(&l.name),
+        ));
     }
 
     let sync_btn = sync_button(base, lang);
diff --git a/crates/myapps-leanfin/src/expenses.rs b/crates/myapps-leanfin/src/expenses.rs
index 6c35713..38f5d13 100644
--- a/crates/myapps-leanfin/src/expenses.rs
+++ b/crates/myapps-leanfin/src/expenses.rs
@@ -6,6 +6,7 @@ use std::collections::{BTreeMap, HashMap};
 use super::dashboard::leanfin_nav;
 use super::services::expenses::{self, ExpensePoint};
 use myapps_core::auth::UserId;
+use myapps_core::components::html_escape;
 use myapps_core::i18n::Lang;
 use myapps_core::layout::render_page;
 use myapps_core::routes::AppState;
@@ -71,7 +72,7 @@ async fn page(
             r##"<button type="button" class="label-badge label-pill" style="--label-color:{color}"
                     data-label-id="{id}" onclick="toggleLabel(this)">{name}</button> "##,
             id = l.id,
-            name = l.name,
+            name = html_escape(&l.name),
         ));
     }
 
diff --git a/crates/myapps-leanfin/src/i18n.rs b/crates/myapps-leanfin/src/i18n.rs
index 3bebb18..70bc1b7 100644
--- a/crates/myapps-leanfin/src/i18n.rs
+++ b/crates/myapps-leanfin/src/i18n.rs
@@ -54,6 +54,20 @@ pub struct Translations {
     pub acc_no_bank: &'static str,
     pub acc_no_manual: &'static str,
     pub acc_configure_eb: &'static str,
+
+    // ── Indexa Capital ───────────────────────────────────────
+    pub acc_indexa_accounts: &'static str,
+    pub acc_indexa_link: &'static str,
+    pub acc_indexa_configure: &'static str,
+    pub acc_no_indexa: &'static str,
+    pub acc_indexa_link_title: &'static str,
+    pub acc_indexa_link_subtitle: &'static str,
+    pub acc_indexa_link_submit: &'static str,
+    pub acc_indexa_already_linked: &'static str,
+    pub acc_indexa_error: &'static str,
+    pub set_indexa_token: &'static str,
+    pub set_indexa_placeholder: &'static str,
+    pub set_indexa_hint: &'static str,
     pub acc_show_archived: &'static str,
     pub acc_archived: &'static str,
     pub acc_expired: &'static str,
@@ -219,7 +233,7 @@ pub const EN: Translations = Translations {
 
     // ── Accounts ─────────────────────────────────────────────
     acc_title: "Accounts",
-    acc_subtitle: "Manage your linked bank connections and manual accounts",
+    acc_subtitle: "Manage your linked bank connections, investment accounts and manual accounts",
     acc_bank_accounts: "Bank Accounts",
     acc_manual_accounts: "Manual Accounts",
     acc_link: "+ Link account",
@@ -227,6 +241,18 @@ pub const EN: Translations = Translations {
     acc_no_bank: "No bank accounts linked yet.",
     acc_no_manual: "No manual accounts yet.",
     acc_configure_eb: "Configure Enable Banking",
+    acc_indexa_accounts: "Indexa Capital",
+    acc_indexa_link: "+ Link Indexa account",
+    acc_indexa_configure: "Configure Indexa token",
+    acc_no_indexa: "No Indexa accounts linked yet.",
+    acc_indexa_link_title: "Link an Indexa Capital account",
+    acc_indexa_link_subtitle: "Select the accounts your API token can read.",
+    acc_indexa_link_submit: "Link selected",
+    acc_indexa_already_linked: "already linked",
+    acc_indexa_error: "Could not reach Indexa Capital. Check that your API token is still valid.",
+    set_indexa_token: "Indexa Capital API token",
+    set_indexa_placeholder: "Paste token to set or replace",
+    set_indexa_hint: "Generate a read-only token in Indexa: Settings \u{2192} Applications. Leave empty to keep the current token.",
     acc_show_archived: "Show archived",
     acc_archived: "Archived",
     acc_expired: "Expired",
@@ -392,7 +418,7 @@ pub const ES: Translations = Translations {
 
     // ── Accounts ─────────────────────────────────────────────
     acc_title: "Cuentas",
-    acc_subtitle: "Gestiona tus conexiones bancarias y cuentas manuales",
+    acc_subtitle: "Gestiona tus conexiones bancarias, cuentas de inversión y cuentas manuales",
     acc_bank_accounts: "Cuentas Bancarias",
     acc_manual_accounts: "Cuentas Manuales",
     acc_link: "+ Vincular cuenta",
@@ -400,6 +426,18 @@ pub const ES: Translations = Translations {
     acc_no_bank: "Sin cuentas bancarias vinculadas aún.",
     acc_no_manual: "Sin cuentas manuales aún.",
     acc_configure_eb: "Configurar Enable Banking",
+    acc_indexa_accounts: "Indexa Capital",
+    acc_indexa_link: "+ Vincular cuenta Indexa",
+    acc_indexa_configure: "Configurar token de Indexa",
+    acc_no_indexa: "Sin cuentas de Indexa vinculadas aún.",
+    acc_indexa_link_title: "Vincular cuenta de Indexa Capital",
+    acc_indexa_link_subtitle: "Selecciona las cuentas que tu token de API puede leer.",
+    acc_indexa_link_submit: "Vincular seleccionadas",
+    acc_indexa_already_linked: "ya vinculada",
+    acc_indexa_error: "No se pudo conectar con Indexa Capital. Comprueba que tu token de API sigue siendo válido.",
+    set_indexa_token: "Token de API de Indexa Capital",
+    set_indexa_placeholder: "Pega el token para establecerlo o reemplazarlo",
+    set_indexa_hint: "Genera un token de solo lectura en Indexa: Ajustes \u{2192} Aplicaciones. Deja vacío para mantener el actual.",
     acc_show_archived: "Mostrar archivadas",
     acc_archived: "Archivada",
     acc_expired: "Expirada",
diff --git a/crates/myapps-leanfin/src/labels.rs b/crates/myapps-leanfin/src/labels.rs
index 727bce0..e9d4347 100644
--- a/crates/myapps-leanfin/src/labels.rs
+++ b/crates/myapps-leanfin/src/labels.rs
@@ -8,6 +8,7 @@ use serde::Deserialize;
 
 use super::dashboard::leanfin_nav;
 use myapps_core::auth::UserId;
+use myapps_core::components::html_escape;
 use myapps_core::i18n::Lang;
 use myapps_core::layout::render_page;
 use myapps_core::routes::AppState;
@@ -71,7 +72,7 @@ async fn list_labels(
     for l in &labels {
         let color = l.color.as_deref().unwrap_or("#6B6B6B");
         let id = l.id;
-        let name = &l.name;
+        let name = html_escape(&l.name);
         let rules_url = format!("{base}/leanfin/labels/{id}/rules");
         let delete_url = format!("{base}/leanfin/labels/{id}/delete");
         let edit_url = format!("{base}/leanfin/labels/{id}/edit");
diff --git a/crates/myapps-leanfin/src/models/account.rs b/crates/myapps-leanfin/src/models/account.rs
index 4f595ab..794a746 100644
--- a/crates/myapps-leanfin/src/models/account.rs
+++ b/crates/myapps-leanfin/src/models/account.rs
@@ -22,7 +22,9 @@ pub struct Account {
 
 impl Account {
     pub fn display_name(&self) -> String {
-        if self.is_manual() {
+        // Bank accounts are identified by IBAN; manual and Indexa accounts
+        // carry a user- or provider-supplied name instead.
+        if self.account_type != "bank" {
             self.account_name
                 .clone()
                 .unwrap_or_else(|| self.bank_name.clone())
diff --git a/crates/myapps-leanfin/src/services/balance.rs b/crates/myapps-leanfin/src/services/balance.rs
index ca191c4..a81c9ea 100644
--- a/crates/myapps-leanfin/src/services/balance.rs
+++ b/crates/myapps-leanfin/src/services/balance.rs
@@ -8,10 +8,13 @@ use myapps_core::config::Config;
 
 /// Determine the timestamp to store for a given balance type.
 /// - ITAV, XPCD, ITBD → now (intraday snapshots)
-/// - CLAV, CLBD → close of business ({reference_date}T23:59:59Z or today)
+/// - CLAV, CLBD, INDEXA → close of business ({reference_date}T23:59:59Z or today)
+///
+/// INDEXA valuations are struck once per day by the fund depositary, so they
+/// behave like a closing balance rather than an intraday one.
 pub fn timestamp_for_balance_type(balance_type: &str, reference_date: Option<&str>) -> String {
     match balance_type {
-        "CLAV" | "CLBD" => {
+        "CLAV" | "CLBD" | "INDEXA" => {
             let date = reference_date.unwrap_or_else(|| {
                 // Leak is fine for a short-lived string; avoids lifetime issues.
                 // In practice reference_date is almost always Some.
@@ -188,8 +191,9 @@ pub fn fill_balance_gaps(series: &[BalancePoint], days: i64) -> Vec<BalancePoint
 
 /// Query daily balance series for a single account.
 /// For bank accounts, computes balances on the fly from the most recent reported
-/// balance and transaction sums. For manual accounts, uses stored reported rows
-/// with gap-filling.
+/// balance and transaction sums. For every other account type (manual, indexa),
+/// uses stored reported rows with gap-filling — they have snapshots but no
+/// transactions to walk, so the backward-walk path would yield nothing.
 pub async fn get_balance_series(
     pool: &SqlitePool,
     account_id: i64,
@@ -206,7 +210,7 @@ pub async fn get_balance_series(
             .fetch_one(pool)
             .await?;
 
-    if account_type == "manual" {
+    if account_type != "bank" {
         let rows: Vec<BalancePoint> = sqlx::query_as(
             r#"SELECT date, balance FROM leanfin_balance_snapshots
                WHERE account_id = ? AND date >= ?
diff --git a/crates/myapps-leanfin/src/services/indexa.rs b/crates/myapps-leanfin/src/services/indexa.rs
new file mode 100644
index 0000000..20156ef
--- /dev/null
+++ b/crates/myapps-leanfin/src/services/indexa.rs
@@ -0,0 +1,309 @@
+//! Indexa Capital API client (read-only).
+//!
+//! Auth is a long-lived personal token generated by the user in Indexa's
+//! private area (Ajustes → Aplicaciones), sent as `X-AUTH-TOKEN`. Unlike the
+//! PSD2 consents behind Enable Banking, it does not expire, so Indexa-backed
+//! accounts never need re-authorization.
+//!
+//! # Privacy
+//!
+//! `/users/me` and `/accounts/{n}` embed heavy personal data — postal address,
+//! email, national ID document numbers, risk-profile answers. Those responses
+//! are therefore **never** written to `leanfin_api_payloads`. Only
+//! `/portfolio` and `/performance`, which contain no personal data, are logged.
+
+use anyhow::{Context, Result};
+use serde::Deserialize;
+use sqlx::SqlitePool;
+use std::collections::HashMap;
+use std::time::Instant;
+
+const API_BASE: &str = "https://api.indexacapital.com";
+
+// ── Auth ──────────────────────────────────────────────────────────
+
+fn client(token: &str) -> Result<reqwest::Client> {
+    let mut headers = reqwest::header::HeaderMap::new();
+    let mut value = reqwest::header::HeaderValue::from_str(token)
+        .context("Indexa token contains invalid header characters")?;
+    // Keep the token out of any `HeaderMap` Debug output that ends up in logs.
+    value.set_sensitive(true);
+    headers.insert("X-AUTH-TOKEN", value);
+    reqwest::Client::builder()
+        .default_headers(headers)
+        .build()
+        .context("failed to build HTTP client")
+}
+
+/// Reject anything that could escape the `/accounts/{n}/...` path segment.
+/// Indexa account numbers are short alphanumeric codes (e.g. 8 chars).
+fn validate_account_number(account_number: &str) -> Result<()> {
+    if account_number.is_empty()
+        || account_number.len() > 32
+        || !account_number
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '-')
+    {
+        anyhow::bail!("invalid Indexa account number");
+    }
+    Ok(())
+}
+
+// ── API types ─────────────────────────────────────────────────────
+
+/// One entry of `/users/me` → `accounts[]`. Only the non-personal fields we
+/// need are deserialized; serde ignores the rest of the payload.
+#[derive(Deserialize)]
+pub struct IndexaAccount {
+    pub account_number: String,
+    #[serde(rename = "type")]
+    pub account_type: String,
+    pub status: String,
+    pub currency: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct UsersMeResponse {
+    accounts: Vec<IndexaAccount>,
+}
+
+/// `/accounts/{n}/portfolio` → `portfolio`. The daily valuation.
+#[derive(Deserialize)]
+pub struct Portfolio {
+    pub total_amount: f64,
+    pub cash_amount: f64,
+    pub instruments_amount: f64,
+    /// Valuation date, `YYYY-MM-DD`.
+    pub date: String,
+}
+
+#[derive(Deserialize)]
+struct PortfolioResponse {
+    portfolio: Portfolio,
+}
+
+/// One daily valuation from `/accounts/{n}/performance` → `portfolios[]`.
+/// Richer than the `YYYYMMDD`-keyed `return.total_amounts` map and already
+/// carries an ISO date, so it is what the history backfill reads.
+#[derive(Deserialize)]
+pub struct PortfolioPoint {
+    /// `YYYY-MM-DD`.
+    pub date: String,
+    pub total_amount: f64,
+}
+
+#[derive(Deserialize)]
+pub struct Performance {
+    #[serde(default)]
+    pub portfolios: Vec<PortfolioPoint>,
+    #[serde(rename = "return", default)]
+    pub returns: Option<Returns>,
+}
+
+/// `/accounts/{n}/performance` → `return`. Several fields are null until the
+/// account has enough history, hence the `Option`s.
+#[derive(Deserialize, Default)]
+pub struct Returns {
+    pub total_amount: Option<f64>,
+    pub investment: Option<f64>,
+    pub pl: Option<f64>,
+    pub time_return: Option<f64>,
+    pub time_return_annual: Option<f64>,
+    pub money_return: Option<f64>,
+    pub money_return_annual: Option<f64>,
+    pub volatility: Option<f64>,
+    /// Date-keyed (`YYYYMMDD`) series of cumulative net contributions.
+    #[serde(default)]
+    pub net_amounts: HashMap<String, f64>,
+}
+
+// ── Payload logging ───────────────────────────────────────────────
+
+/// Mirrors `enable_banking::save_payload` but tags rows with `provider = 'indexa'`.
+/// Only ever called for responses known to be free of personal data.
+async fn save_payload(
+    pool: &SqlitePool,
+    account_id: Option<i64>,
+    method: &str,
+    endpoint: &str,
+    response_body: &str,
+    status_code: u16,
+    duration_ms: u64,
+) {
+    if let Err(e) = sqlx::query(
+        r#"INSERT INTO leanfin_api_payloads (account_id, provider, method, endpoint, request_body, response_body, status_code, duration_ms)
+           VALUES (?, 'indexa', ?, ?, NULL, ?, ?, ?)"#,
+    )
+    .bind(account_id)
+    .bind(method)
+    .bind(endpoint)
+    .bind(response_body)
+    .bind(status_code as i32)
+    .bind(duration_ms as i64)
+    .execute(pool)
+    .await
+    {
+        tracing::warn!("Failed to save Indexa API payload: {e:#}");
+    }
+}
+
+// ── API calls ─────────────────────────────────────────────────────
+
+/// List the accounts the token can read.
+///
+/// Deliberately **not** payload-logged: `/users/me` carries the user's postal
+/// address, email and national ID.
+pub async fn list_accounts(token: &str) -> Result<Vec<IndexaAccount>> {
+    let resp = client(token)?
+        .get(format!("{API_BASE}/users/me"))
+        .send()
+        .await
+        .context("failed to send Indexa /users/me request")?;
+
+    let status_code = resp.status().as_u16();
+    let text = resp
+        .text()
+        .await
+        .context("failed to read Indexa /users/me response")?;
+
+    if status_code >= 400 {
+        // The body may echo request context; keep it out of the error.
+        anyhow::bail!("Indexa /users/me failed ({status_code})");
+    }
+
+    let data: UsersMeResponse =
+        serde_json::from_str(&text).context("failed to parse Indexa /users/me response")?;
+    Ok(data.accounts)
+}
+
+/// Current portfolio valuation. This is the only call the routine sync needs.
+pub async fn get_portfolio(
+    pool: &SqlitePool,
+    token: &str,
+    account_number: &str,
+    account_id: Option<i64>,
+) -> Result<Portfolio> {
+    validate_account_number(account_number)?;
+    let start = Instant::now();
+
+    let resp = client(token)?
+        .get(format!("{API_BASE}/accounts/{account_number}/portfolio"))
+        .send()
+        .await
+        .context("failed to send Indexa portfolio request")?;
+
+    let status_code = resp.status().as_u16();
+    let text = resp
+        .text()
+        .await
+        .context("failed to read Indexa portfolio response")?;
+    let duration_ms = start.elapsed().as_millis() as u64;
+
+    save_payload(
+        pool,
+        account_id,
+        "GET",
+        "/accounts/{n}/portfolio",
+        &text,
+        status_code,
+        duration_ms,
+    )
+    .await;
+
+    if status_code >= 400 {
+        anyhow::bail!("Indexa portfolio failed ({status_code})");
+    }
+
+    let data: PortfolioResponse =
+        serde_json::from_str(&text).context("failed to parse Indexa portfolio response")?;
+    Ok(data.portfolio)
+}
+
+/// Full performance payload, including the daily valuation history used to
+/// backfill `leanfin_balance_snapshots` when an account is first linked.
+pub async fn get_performance(
+    pool: &SqlitePool,
+    token: &str,
+    account_number: &str,
+    account_id: Option<i64>,
+) -> Result<Performance> {
+    validate_account_number(account_number)?;
+    let start = Instant::now();
+
+    let resp = client(token)?
+        .get(format!("{API_BASE}/accounts/{account_number}/performance"))
+        .send()
+        .await
+        .context("failed to send Indexa performance request")?;
+
+    let status_code = resp.status().as_u16();
+    let text = resp
+        .text()
+        .await
+        .context("failed to read Indexa performance response")?;
+    let duration_ms = start.elapsed().as_millis() as u64;
+
+    save_payload(
+        pool,
+        account_id,
+        "GET",
+        "/accounts/{n}/performance",
+        &text,
+        status_code,
+        duration_ms,
+    )
+    .await;
+
+    if status_code >= 400 {
+        anyhow::bail!("Indexa performance failed ({status_code})");
+    }
+
+    serde_json::from_str(&text).context("failed to parse Indexa performance response")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rejects_path_traversal_account_numbers() {
+        assert!(validate_account_number("ABC1DE2F").is_ok());
+        assert!(validate_account_number("abc-123").is_ok());
+        assert!(validate_account_number("").is_err());
+        assert!(validate_account_number("../users/me").is_err());
+        assert!(validate_account_number("ABC/portfolio").is_err());
+        assert!(validate_account_number("ABC 1DE").is_err());
+        assert!(validate_account_number(&"A".repeat(33)).is_err());
+    }
+
+    #[test]
+    fn parses_portfolio_response() {
+        let json = r#"{"portfolio":{"total_amount":1234.5,"cash_amount":1234.5,
+            "instruments_amount":0,"instruments_cost":0,"date":"2026-08-28",
+            "created_at":"2026-08-28 00:00:00","inflows":1234.5,"outflows":0,
+            "tax_outflows":0,"accrued_interest":0},"comparison":[],"extra":{}}"#;
+        let parsed: PortfolioResponse = serde_json::from_str(json).unwrap();
+        assert_eq!(parsed.portfolio.total_amount, 1234.5);
+        assert_eq!(parsed.portfolio.date, "2026-08-28");
+        assert_eq!(parsed.portfolio.instruments_amount, 0.0);
+    }
+
+    #[test]
+    fn parses_performance_with_null_returns() {
+        // Fresh accounts return nulls for the longer-horizon return fields.
+        let json = r#"{"portfolios":[{"date":"2026-08-28","total_amount":100.0,
+            "cash_amount":100.0,"instruments_amount":0,"instruments_cost":0,
+            "inflows":100.0,"outflows":0,"tax_outflows":0,"accrued_interest":0,
+            "created_at":"2026-08-28 00:00:00"}],
+            "return":{"time_return":0.0,"time_return_last_week":null,
+            "time_return_annual":0.0,"total_amount":100.0,"investment":100.0,
+            "pl":0.0,"volatility":0.0,"net_amounts":{"20260828":100.0}},
+            "performance":{},"history":[],"benchmark":[]}"#;
+        let parsed: Performance = serde_json::from_str(json).unwrap();
+        assert_eq!(parsed.portfolios.len(), 1);
+        assert_eq!(parsed.portfolios[0].date, "2026-08-28");
+        let returns = parsed.returns.unwrap();
+        assert_eq!(returns.time_return, Some(0.0));
+        assert_eq!(returns.net_amounts.get("20260828"), Some(&100.0));
+    }
+}
diff --git a/crates/myapps-leanfin/src/services/mod.rs b/crates/myapps-leanfin/src/services/mod.rs
index c5b7dbc..cf89c3d 100644
--- a/crates/myapps-leanfin/src/services/mod.rs
+++ b/crates/myapps-leanfin/src/services/mod.rs
@@ -2,6 +2,7 @@ pub mod balance;
 pub mod csv_import;
 pub mod enable_banking;
 pub mod expenses;
+pub mod indexa;
 pub mod labeling;
 pub mod seed;
 pub mod sync;
diff --git a/crates/myapps-leanfin/src/services/sync.rs b/crates/myapps-leanfin/src/services/sync.rs
index 18f1a8e..afec0f0 100644
--- a/crates/myapps-leanfin/src/services/sync.rs
+++ b/crates/myapps-leanfin/src/services/sync.rs
@@ -4,6 +4,7 @@ use sqlx::SqlitePool;
 
 use super::super::settings::{self, EnableBankingCredentials};
 use super::enable_banking;
+use super::indexa;
 use crate::models::Account;
 use myapps_core::config::Config;
 
@@ -26,8 +27,7 @@ pub async fn run(pool: &SqlitePool, config: &Config) -> Result<()> {
     .await?;
 
     if accounts.is_empty() {
-        tracing::info!("No linked bank accounts, nothing to sync");
-        return Ok(());
+        tracing::info!("No linked bank accounts");
     }
 
     // Group accounts by user_id to fetch credentials once per user
@@ -109,9 +109,34 @@ pub async fn run(pool: &SqlitePool, config: &Config) -> Result<()> {
         }
     }
 
+    // Indexa Capital accounts: independent of Enable Banking credentials and of
+    // consent expiry, so they sync even when no bank account is linked.
+    let indexa_users: Vec<i64> = sqlx::query_scalar(
+        "SELECT DISTINCT user_id FROM leanfin_accounts WHERE account_type = 'indexa' AND archived = 0",
+    )
+    .fetch_all(pool)
+    .await
+    .unwrap_or_else(|e| {
+        tracing::error!("DB query failed: {e:#}");
+        Default::default()
+    });
+
+    let mut indexa_result = SyncResult {
+        total_new: 0,
+        accounts_synced: 0,
+        accounts_skipped: 0,
+        errors: Vec::new(),
+        reconciliation_warnings: Vec::new(),
+    };
+    for user_id in indexa_users {
+        sync_indexa_for_user(pool, user_id, config, &mut indexa_result, true).await;
+    }
+
     tracing::info!(
-        "Sync complete: {total_new} new transactions across {} accounts",
-        accounts.len()
+        "Sync complete: {total_new} new transactions across {} bank accounts, {} Indexa accounts valued ({} failed)",
+        accounts.len(),
+        indexa_result.accounts_synced,
+        indexa_result.accounts_skipped,
     );
 
     Ok(())
@@ -279,6 +304,126 @@ async fn sync_account(
     Ok((inserted, reconciliation_warning))
 }
 
+// ── Indexa Capital ────────────────────────────────────────────────
+
+/// Sync one Indexa-backed account: fetch the current portfolio valuation,
+/// update the cached balance and record a daily snapshot.
+///
+/// Only `/portfolio` is called. It is the sole Indexa endpoint that carries
+/// both the valuation and no personal data, so the routine sync never touches
+/// the PII-bearing `/users/me` or `/accounts/{n}`.
+async fn sync_indexa_account(pool: &SqlitePool, token: &str, account: &Account) -> Result<()> {
+    let portfolio =
+        indexa::get_portfolio(pool, token, &account.account_uid, Some(account.id)).await?;
+
+    sqlx::query(
+        "UPDATE leanfin_accounts SET balance_amount = ?, balance_currency = 'EUR' WHERE id = ?",
+    )
+    .bind(portfolio.total_amount)
+    .bind(account.id)
+    .execute(pool)
+    .await?;
+
+    let timestamp = super::balance::timestamp_for_balance_type("INDEXA", Some(&portfolio.date));
+    super::balance::record_balance_snapshot(
+        pool,
+        account.id,
+        portfolio.total_amount,
+        "INDEXA",
+        &timestamp,
+    )
+    .await?;
+
+    Ok(())
+}
+
+/// Backfill an Indexa account's full valuation history into
+/// `leanfin_balance_snapshots`, so the balance-evolution chart shows the
+/// account from its opening date rather than from the day it was linked.
+///
+/// Unlike PSD2 (90 days at best), Indexa returns the whole series, so this only
+/// needs to run once at link time. Returns the number of snapshots written.
+pub async fn backfill_indexa_history(
+    pool: &SqlitePool,
+    token: &str,
+    account: &Account,
+) -> Result<u64> {
+    let performance =
+        indexa::get_performance(pool, token, &account.account_uid, Some(account.id)).await?;
+
+    let mut written = 0u64;
+    for point in &performance.portfolios {
+        let timestamp = super::balance::timestamp_for_balance_type("INDEXA", Some(&point.date));
+        match super::balance::record_balance_snapshot(
+            pool,
+            account.id,
+            point.total_amount,
+            "INDEXA",
+            &timestamp,
+        )
+        .await
+        {
+            Ok(_) => written += 1,
+            Err(e) => tracing::warn!(
+                "Indexa backfill: failed to record snapshot for {}: {e:#}",
+                point.date
+            ),
+        }
+    }
+
+    Ok(written)
+}
+
+/// Sync every Indexa account belonging to `user_id`, folding outcomes into `result`.
+async fn sync_indexa_for_user(
+    pool: &SqlitePool,
+    user_id: i64,
+    config: &Config,
+    result: &mut SyncResult,
+    notify: bool,
+) {
+    let token = match settings::get_indexa_token(pool, config, user_id).await {
+        Ok(t) => t,
+        Err(_) => return, // Not configured for this user — nothing to do.
+    };
+
+    let accounts: Vec<Account> = sqlx::query_as(
+        "SELECT id, user_id, bank_name, bank_country, iban, session_id, account_uid, session_expires_at, balance_amount, balance_currency, account_type, account_name, asset_category, color, archived, created_at FROM leanfin_accounts WHERE user_id = ? AND account_type = 'indexa' AND archived = 0",
+    )
+    .bind(user_id)
+    .fetch_all(pool)
+    .await
+    .unwrap_or_else(|e| {
+        tracing::error!("DB query failed: {e:#}");
+        Default::default()
+    });
+
+    for account in &accounts {
+        match sync_indexa_account(pool, &token, account).await {
+            Ok(()) => {
+                result.accounts_synced += 1;
+                tracing::info!("Indexa account '{}': valuation updated", account.bank_name);
+            }
+            Err(e) => {
+                result.accounts_skipped += 1;
+                result
+                    .errors
+                    .push(format!("'{}': {e:#}", account.bank_name));
+                tracing::error!("Indexa account '{}': sync failed: {e:#}", account.bank_name);
+                if notify {
+                    myapps_core::services::notify::send(
+                        pool,
+                        config,
+                        "LeanFin",
+                        &format!("Indexa sync failed for '{}': {e:#}", account.bank_name),
+                    )
+                    .await;
+                }
+            }
+        }
+    }
+}
+
 /// Run sync for a single user's accounts, returning a structured result for UI display.
 pub async fn run_for_user(pool: &SqlitePool, config: &Config, user_id: i64) -> SyncResult {
     run_for_user_inner(pool, config, user_id, None).await
@@ -312,57 +457,64 @@ async fn run_for_user_inner(
         reconciliation_warnings: Vec::new(),
     };
 
+    // Enable Banking credentials are optional: a user may have only Indexa
+    // accounts linked, which need no Enable Banking setup at all.
     let creds = match settings::get_credentials(pool, config, user_id).await {
-        Ok(c) => c,
+        Ok(c) => Some(c),
         Err(_) => {
             tracing::info!(
-                "User {user_id}: no Enable Banking credentials configured, skipping sync"
+                "User {user_id}: no Enable Banking credentials configured, skipping bank sync"
             );
-            return result;
+            None
         }
     };
 
-    let accounts: Vec<Account> = sqlx::query_as(
-        "SELECT id, user_id, bank_name, bank_country, iban, session_id, account_uid, session_expires_at, balance_amount, balance_currency, account_type, account_name, asset_category, color, archived, created_at FROM leanfin_accounts WHERE user_id = ? AND account_type = 'bank' AND archived = 0",
-    )
-    .bind(user_id)
-    .fetch_all(pool)
-    .await
-    .unwrap_or_else(|e| {
-        tracing::error!("DB query failed: {e:#}");
-        Default::default()
-    });
+    if let Some(creds) = &creds {
+        let accounts: Vec<Account> = sqlx::query_as(
+            "SELECT id, user_id, bank_name, bank_country, iban, session_id, account_uid, session_expires_at, balance_amount, balance_currency, account_type, account_name, asset_category, color, archived, created_at FROM leanfin_accounts WHERE user_id = ? AND account_type = 'bank' AND archived = 0",
+        )
+        .bind(user_id)
+        .fetch_all(pool)
+        .await
+        .unwrap_or_else(|e| {
+            tracing::error!("DB query failed: {e:#}");
+            Default::default()
+        });
 
-    let now = Utc::now().naive_utc();
+        let now = Utc::now().naive_utc();
 
-    for account in &accounts {
-        let days_until_expiry = (account.session_expires_at - now).num_days();
-
-        if days_until_expiry <= 0 {
-            result.accounts_skipped += 1;
-            result
-                .errors
-                .push(format!("'{}': session expired", account.bank_name,));
-            continue;
-        }
+        for account in &accounts {
+            let days_until_expiry = (account.session_expires_at - now).num_days();
 
-        match sync_account(pool, config, &creds, account, lookback_override).await {
-            Ok((count, warning)) => {
-                result.total_new += count;
-                result.accounts_synced += 1;
-                if let Some(w) = warning {
-                    result.reconciliation_warnings.push(w);
-                }
-            }
-            Err(e) => {
+            if days_until_expiry <= 0 {
                 result.accounts_skipped += 1;
                 result
                     .errors
-                    .push(format!("'{}': {e:#}", account.bank_name,));
+                    .push(format!("'{}': session expired", account.bank_name,));
+                continue;
+            }
+
+            match sync_account(pool, config, creds, account, lookback_override).await {
+                Ok((count, warning)) => {
+                    result.total_new += count;
+                    result.accounts_synced += 1;
+                    if let Some(w) = warning {
+                        result.reconciliation_warnings.push(w);
+                    }
+                }
+                Err(e) => {
+                    result.accounts_skipped += 1;
+                    result
+                        .errors
+                        .push(format!("'{}': {e:#}", account.bank_name,));
+                }
             }
         }
     }
 
+    // Indexa accounts sync regardless of Enable Banking configuration.
+    sync_indexa_for_user(pool, user_id, config, &mut result, false).await;
+
     tracing::info!(
         "User {user_id} sync complete: {} new transactions, {} accounts synced, {} errors",
         result.total_new,
diff --git a/crates/myapps-leanfin/src/settings.rs b/crates/myapps-leanfin/src/settings.rs
index 0af962d..4d5e011 100644
--- a/crates/myapps-leanfin/src/settings.rs
+++ b/crates/myapps-leanfin/src/settings.rs
@@ -7,6 +7,7 @@ use sqlx::SqlitePool;
 
 use super::dashboard::leanfin_nav;
 use myapps_core::auth::UserId;
+use myapps_core::components::html_escape;
 use myapps_core::config::Config;
 use myapps_core::i18n::Lang;
 use myapps_core::layout::render_page;
@@ -97,6 +98,38 @@ pub async fn get_credentials(
     })
 }
 
+/// Decrypt the user's Indexa Capital personal API token.
+///
+/// The token is long-lived and grants read access to every account the user
+/// holds, so it is stored encrypted at rest and must never be logged.
+pub async fn get_indexa_token(pool: &SqlitePool, config: &Config, user_id: i64) -> Result<String> {
+    let encryption_key = config
+        .encryption_key
+        .as_deref()
+        .context("ENCRYPTION_KEY not configured")?;
+
+    let encrypted: Vec<u8> =
+        sqlx::query_scalar("SELECT indexa_token FROM leanfin_user_settings WHERE user_id = ?")
+            .bind(user_id)
+            .fetch_optional(pool)
+            .await?
+            .flatten()
+            .context("Indexa token not configured")?;
+
+    let token_bytes = decrypt(&encrypted, encryption_key)?;
+    String::from_utf8(token_bytes).context("invalid UTF-8 in decrypted Indexa token")
+}
+
+pub async fn has_indexa_token(pool: &SqlitePool, user_id: i64) -> bool {
+    sqlx::query_scalar::<_, bool>(
+        "SELECT EXISTS(SELECT 1 FROM leanfin_user_settings WHERE user_id = ? AND indexa_token IS NOT NULL)",
+    )
+    .bind(user_id)
+    .fetch_one(pool)
+    .await
+    .unwrap_or(false)
+}
+
 pub async fn has_credentials(pool: &SqlitePool, user_id: i64) -> bool {
     sqlx::query_scalar::<_, bool>(
         "SELECT EXISTS(SELECT 1 FROM leanfin_user_settings WHERE user_id = ? AND enable_banking_app_id IS NOT NULL AND enable_banking_key IS NOT NULL)",
@@ -131,8 +164,9 @@ async fn settings_form(
     .flatten();
 
     let has_key = has_credentials(&state.pool, user_id.0).await;
+    let has_indexa = has_indexa_token(&state.pool, user_id.0).await;
 
-    let app_id_value = current_app_id.as_deref().unwrap_or("");
+    let app_id_value = html_escape(current_app_id.as_deref().unwrap_or(""));
     let key_status = if has_key {
         format!(r#"<span class="status-ok">{}</span>"#, t.set_configured)
     } else {
@@ -141,6 +175,14 @@ async fn settings_form(
             t.set_not_configured
         )
     };
+    let indexa_status = if has_indexa {
+        format!(r#"<span class="status-ok">{}</span>"#, t.set_configured)
+    } else {
+        format!(
+            r#"<span class="status-missing">{}</span>"#,
+            t.set_not_configured
+        )
+    };
 
     let encryption_ok = state.config.encryption_key.is_some();
     let encryption_warning = if !encryption_ok {
@@ -168,6 +210,11 @@ async fn settings_form(
                     <label>{private_key} — {key_status}</label>
                     <input type="file" id="key_file" name="key_file" accept=".pem,.key">
                     <p class="form-hint">{key_hint}</p>
+                    <hr class="settings-divider">
+                    <label for="indexa_token">{indexa_token_label} — {indexa_status}</label>
+                    <input type="password" id="indexa_token" name="indexa_token"
+                           autocomplete="off" placeholder="{indexa_placeholder}">
+                    <p class="form-hint">{indexa_hint}</p>
                     <div style="display:flex; gap:0.75rem; margin-top:1rem;">
                         <a href="{base}/leanfin" class="btn btn-secondary">{cancel}</a>
                         <button type="submit" style="flex:1"{submit_disabled}>{save}</button>
@@ -180,6 +227,9 @@ async fn settings_form(
         app_id_label = t.set_app_id,
         private_key = t.set_private_key,
         key_hint = t.set_key_hint,
+        indexa_token_label = t.set_indexa_token,
+        indexa_placeholder = t.set_indexa_placeholder,
+        indexa_hint = t.set_indexa_hint,
         cancel = t.set_cancel,
         save = t.set_save,
     );
@@ -212,6 +262,7 @@ async fn settings_submit(
 
     let mut app_id: Option<String> = None;
     let mut key_pem: Option<Vec<u8>> = None;
+    let mut indexa_token: Option<String> = None;
 
     while let Ok(Some(field)) = multipart.next_field().await {
         let name = field.name().unwrap_or("").to_string();
@@ -226,6 +277,14 @@ async fn settings_submit(
                     key_pem = Some(bytes.to_vec());
                 }
             }
+            "indexa_token" => {
+                indexa_token = field
+                    .text()
+                    .await
+                    .ok()
+                    .map(|s| s.trim().to_string())
+                    .filter(|s| !s.is_empty());
+            }
             _ => {}
         }
     }
@@ -300,14 +359,39 @@ async fn settings_submit(
         .await
     };
 
-    match result {
-        Ok(_) => {
-            tracing::info!("Updated Enable Banking settings for user {}", user_id.0);
-            axum::response::Redirect::to(&format!("{base}/leanfin/settings")).into_response()
-        }
-        Err(e) => {
-            tracing::error!("Failed to save settings: {e}");
-            Html("Failed to save settings".to_string()).into_response()
+    if let Err(e) = result {
+        tracing::error!("Failed to save settings: {e}");
+        return Html("Failed to save settings".to_string()).into_response();
+    }
+    tracing::info!("Updated Enable Banking settings for user {}", user_id.0);
+
+    // Indexa token: written separately so that leaving the field blank keeps
+    // the stored token rather than wiping it.
+    if let Some(token) = indexa_token {
+        let encrypted = match encrypt(token.as_bytes(), encryption_key) {
+            Ok(enc) => enc,
+            Err(e) => {
+                tracing::error!("Failed to encrypt Indexa token: {e:#}");
+                return Html("Failed to encrypt Indexa token".to_string()).into_response();
+            }
+        };
+        if let Err(e) = sqlx::query(
+            r#"INSERT INTO leanfin_user_settings (user_id, indexa_token, updated_at)
+               VALUES (?, ?, strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
+               ON CONFLICT(user_id) DO UPDATE SET
+                   indexa_token = excluded.indexa_token,
+                   updated_at = excluded.updated_at"#,
+        )
+        .bind(user_id.0)
+        .bind(&encrypted)
+        .execute(&state.pool)
+        .await
+        {
+            tracing::error!("Failed to save Indexa token: {e}");
+            return Html("Failed to save settings".to_string()).into_response();
         }
+        tracing::info!("Updated Indexa token for user {}", user_id.0);
     }
+
+    axum::response::Redirect::to(&format!("{base}/leanfin/settings")).into_response()
 }
diff --git a/crates/myapps-leanfin/src/transactions.rs b/crates/myapps-leanfin/src/transactions.rs
index 00ec970..69e43cd 100644
--- a/crates/myapps-leanfin/src/transactions.rs
+++ b/crates/myapps-leanfin/src/transactions.rs
@@ -8,6 +8,7 @@ use serde::Deserialize;
 
 use super::models::Transaction;
 use myapps_core::auth::UserId;
+use myapps_core::components::html_escape;
 use myapps_core::i18n::Lang;
 use myapps_core::routes::AppState;
 
@@ -65,7 +66,7 @@ fn render_badges(allocs: &[&AllocRow], base: &str, txn_id: i64) -> String {
         };
         html.push_str(&format!(
             r#"<span class="label-badge label-badge-sm" style="--label-color:{color}">{}{display_amount}</span> "#,
-            a.label_name,
+            html_escape(&a.label_name),
         ));
     }
     html.push_str(&format!(
@@ -85,7 +86,7 @@ fn render_row(
     base: &str,
     account_color: Option<&str>,
 ) -> String {
-    let counterparty = t.counterparty.as_deref().unwrap_or("—");
+    let counterparty = html_escape(t.counterparty.as_deref().unwrap_or("—"));
     let sign = if t.amount < 0.0 {
         "negative"
     } else {
@@ -122,7 +123,7 @@ fn render_row(
         </tr>"#,
         id = t.id,
         date = t.date,
-        desc = t.description,
+        desc = html_escape(&t.description),
         amount = t.amount,
         currency = t.currency,
     )
@@ -448,7 +449,7 @@ async fn alloc_editor_inner(
                     <button class="btn-icon btn-icon-danger" type="submit">&times;</button>
                 </form>
             </div>"##,
-            name = a.label_name,
+            name = html_escape(&a.label_name),
             amount = a.amount,
             alloc_id = a.id,
         ));
@@ -465,7 +466,11 @@ async fn alloc_editor_inner(
         if already {
             continue;
         }
-        options.push_str(&format!(r#"<option value="{}">{}</option>"#, l.id, l.name,));
+        options.push_str(&format!(
+            r#"<option value="{}">{}</option>"#,
+            l.id,
+            html_escape(&l.name),
+        ));
     }
 
     let remaining_class = if remaining.abs() < 0.01 {
@@ -475,12 +480,12 @@ async fn alloc_editor_inner(
     };
 
     // Build "Add Rule" form with pre-filled values
-    let counterparty_val = txn_counterparty.as_deref().unwrap_or("");
-    let description_val = &txn_description;
+    let counterparty_val = html_escape(txn_counterparty.as_deref().unwrap_or(""));
+    let description_val = html_escape(&txn_description);
     let (default_field, default_pattern) = if !counterparty_val.is_empty() {
-        ("counterparty", counterparty_val)
+        ("counterparty", counterparty_val.as_str())
     } else {
-        ("description", txn_description.as_str())
+        ("description", description_val.as_str())
     };
 
     let flash_html = if let Some(msg) = flash {
diff --git a/crates/myapps-leanfin/tests/integration.rs b/crates/myapps-leanfin/tests/integration.rs
index 03cb8a3..53a2ef1 100644
--- a/crates/myapps-leanfin/tests/integration.rs
+++ b/crates/myapps-leanfin/tests/integration.rs
@@ -3,7 +3,9 @@ mod leanfin {
     pub mod balance;
     pub mod balance_evolution;
     pub mod csv_import;
+    pub mod escaping;
     pub mod expenses;
+    pub mod indexa;
     pub mod labels;
     pub mod manual_accounts;
     pub mod sync;
diff --git a/crates/myapps-leanfin/tests/leanfin/escaping.rs b/crates/myapps-leanfin/tests/leanfin/escaping.rs
new file mode 100644
index 0000000..4dcde25
--- /dev/null
+++ b/crates/myapps-leanfin/tests/leanfin/escaping.rs
@@ -0,0 +1,59 @@
+//! Regression coverage for HTML escaping of user-controlled strings.
+//!
+//! LeanFin rendered account and label names straight into `format!` templates,
+//! so a name containing markup executed script on the accounts list, the
+//! dashboard and balance-evolution `<option>` lists, and the expenses label
+//! pills. Every render site must escape.
+
+#[tokio::test]
+async fn user_controlled_names_are_html_escaped() {
+    let app = myapps_test_harness::spawn_app(vec![Box::new(myapps_leanfin::LeanFinApp)]).await;
+    app.seed_and_login(&myapps_leanfin::LeanFinApp).await;
+
+    let user_id: i64 = sqlx::query_scalar("SELECT id FROM users WHERE username = 'seeduser'")
+        .fetch_one(&app.pool)
+        .await
+        .expect("seeded user not found");
+
+    let payload = r#"<img src=x onerror="window.__xss=1">"#;
+
+    sqlx::query(
+        r#"INSERT INTO leanfin_accounts
+           (user_id, bank_name, bank_country, session_id, account_uid, session_expires_at,
+            account_type, account_name, asset_category, balance_amount, balance_currency)
+           VALUES (?, ?, 'ES', '', 'xss-acct', '9999-12-31T00:00:00Z',
+                   'manual', ?, 'other', 1.0, 'EUR')"#,
+    )
+    .bind(user_id)
+    .bind(payload)
+    .bind(payload)
+    .execute(&app.pool)
+    .await
+    .expect("failed to insert account");
+
+    sqlx::query("INSERT INTO leanfin_labels (user_id, name, color) VALUES (?, ?, '#ff0000')")
+        .bind(user_id)
+        .bind(payload)
+        .execute(&app.pool)
+        .await
+        .expect("failed to insert label");
+
+    for route in [
+        "/leanfin",
+        "/leanfin/accounts",
+        "/leanfin/balance-evolution",
+        "/leanfin/expenses",
+        "/leanfin/labels",
+        "/leanfin/transactions",
+    ] {
+        let body = app.server.get(route).await.text();
+        assert!(
+            !body.contains("<img src=x"),
+            "{route} rendered an unescaped payload"
+        );
+        assert!(
+            !body.contains(r#"onerror="window.__xss=1""#),
+            "{route} rendered an unescaped event handler"
+        );
+    }
+}
diff --git a/crates/myapps-leanfin/tests/leanfin/indexa.rs b/crates/myapps-leanfin/tests/leanfin/indexa.rs
new file mode 100644
index 0000000..c729c60
--- /dev/null
+++ b/crates/myapps-leanfin/tests/leanfin/indexa.rs
@@ -0,0 +1,139 @@
+//! Indexa Capital provider: settings, account list section and link flow.
+//!
+//! These exercise the routes without touching the live Indexa API — the link
+//! form redirects to settings when no token is stored, which is the state a
+//! freshly seeded user is in.
+
+#[tokio::test]
+async fn accounts_page_shows_indexa_section() {
+    let app = myapps_test_harness::spawn_app(vec![Box::new(myapps_leanfin::LeanFinApp)]).await;
+    app.seed_and_login(&myapps_leanfin::LeanFinApp).await;
+
+    let response = app.server.get("/leanfin/accounts").await;
+    let body = response.text();
+    assert!(
+        body.contains("Indexa Capital"),
+        "missing Indexa Capital heading"
+    );
+    assert!(
+        body.contains("No Indexa accounts linked yet."),
+        "missing Indexa empty state"
+    );
+}
+
+#[tokio::test]
+async fn accounts_page_prompts_for_token_when_unconfigured() {
+    let app = myapps_test_harness::spawn_app(vec![Box::new(myapps_leanfin::LeanFinApp)]).await;
+    app.seed_and_login(&myapps_leanfin::LeanFinApp).await;
+
+    let response = app.server.get("/leanfin/accounts").await;
+    let body = response.text();
+    // Without a stored token the section offers settings, not the link flow.
+    assert!(
+        body.contains("Configure Indexa token"),
+        "missing configure-token call to action"
+    );
+    assert!(
+        !body.contains("/leanfin/accounts/indexa/link"),
+        "link button should be hidden until a token is stored"
+    );
+}
+
+#[tokio::test]
+async fn settings_page_has_indexa_token_field() {
+    let app = myapps_test_harness::spawn_app(vec![Box::new(myapps_leanfin::LeanFinApp)]).await;
+    app.seed_and_login(&myapps_leanfin::LeanFinApp).await;
+
+    let response = app.server.get("/leanfin/settings").await;
+    let body = response.text();
+    assert!(
+        body.contains(r#"name="indexa_token""#),
+        "missing indexa_token field"
+    );
+    assert!(
+        body.contains("Indexa Capital API token"),
+        "missing Indexa token label"
+    );
+    assert!(
+        body.contains(r#"type="password""#),
+        "token field must not render its value in plain text"
+    );
+}
+
+#[tokio::test]
+async fn indexa_link_form_redirects_to_settings_without_token() {
+    let app = myapps_test_harness::spawn_app(vec![Box::new(myapps_leanfin::LeanFinApp)]).await;
+    app.seed_and_login(&myapps_leanfin::LeanFinApp).await;
+
+    let response = app
+        .server
+        .get("/leanfin/accounts/indexa/link")
+        .expect_failure() // 303 redirect
+        .await;
+    response.assert_status(axum::http::StatusCode::SEE_OTHER);
+    let location = response
+        .headers()
+        .get("location")
+        .expect("missing redirect location")
+        .to_str()
+        .unwrap();
+    assert!(
+        location.ends_with("/leanfin/settings"),
+        "expected redirect to settings, got {location}"
+    );
+}
+
+#[tokio::test]
+async fn indexa_link_submit_redirects_to_settings_without_token() {
+    let app = myapps_test_harness::spawn_app(vec![Box::new(myapps_leanfin::LeanFinApp)]).await;
+    app.seed_and_login(&myapps_leanfin::LeanFinApp).await;
+
+    let response = app
+        .server
+        .post("/leanfin/accounts/indexa/link")
+        .form(&serde_json::json!({ "acct_ABC1DE2F": "1" }))
+        .expect_failure() // 303 redirect
+        .await;
+    response.assert_status(axum::http::StatusCode::SEE_OTHER);
+}
+
+#[tokio::test]
+async fn indexa_account_appears_in_balance_evolution_selector() {
+    let app = myapps_test_harness::spawn_app(vec![Box::new(myapps_leanfin::LeanFinApp)]).await;
+    app.seed_and_login(&myapps_leanfin::LeanFinApp).await;
+
+    let user_id: i64 = sqlx::query_scalar("SELECT id FROM users WHERE username = 'seeduser'")
+        .fetch_one(&app.pool)
+        .await
+        .expect("seeded user not found");
+
+    sqlx::query(
+        r#"INSERT INTO leanfin_accounts
+           (user_id, bank_name, bank_country, session_id, account_uid, session_expires_at,
+            account_type, account_name, asset_category, balance_amount, balance_currency)
+           VALUES (?, 'Indexa Capital', 'ES', '', 'ABC1DE2F', '9999-12-31T00:00:00Z',
+                   'indexa', 'Indexa ABC1DE2F', 'investment', 1234.56, 'EUR')"#,
+    )
+    .bind(user_id)
+    .execute(&app.pool)
+    .await
+    .expect("failed to insert Indexa account");
+
+    let accounts = app.server.get("/leanfin/accounts").await.text();
+    assert!(
+        accounts.contains("Indexa ABC1DE2F"),
+        "Indexa account missing from accounts page"
+    );
+    assert!(
+        accounts.contains("1234.56 EUR"),
+        "Indexa balance missing from accounts page"
+    );
+
+    // Indexa accounts must be selectable on the balance chart, which is the
+    // whole point of syncing a valuation the user cannot get over PSD2.
+    let evolution = app.server.get("/leanfin/balance-evolution").await.text();
+    assert!(
+        evolution.contains("Indexa ABC1DE2F"),
+        "Indexa account missing from balance evolution selector"
+    );
+}
diff --git a/docs/architecture.md b/docs/architecture.md
index caf46d4..e89c6be 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -11,6 +11,7 @@
 | Charts           | Chart.js 4.x (client-side)      |
 | Auth             | Argon2 + server-side sessions   |
 | Bank aggregator  | Enable Banking PSD2 API         |
+| Investment data  | Indexa Capital REST API (read-only) |
 | Notifications    | Web Push API (VAPID)            |
 | Speech-to-text   | whisper.cpp (via CLI subprocess) |
 | LLM inference    | llama.cpp server (HTTP API)     |
@@ -130,11 +131,12 @@ After login, the top-level router serves:
 - `/leanfin/` — LeanFin sub-app (nested router)
   - `/leanfin/` — Transactions dashboard
   - `/leanfin/transactions` — Transaction list (HTMX partial)
-  - `/leanfin/accounts` — Account management (bank + manual)
+  - `/leanfin/accounts` — Account management (bank + Indexa + manual)
   - `POST /leanfin/accounts/{id}/reauth` — Re-authorize expired bank session
   - `POST /leanfin/accounts/{id}/delete` — Delete account and its data
   - `POST /leanfin/accounts/{id}/archive` — Archive account (blocked if unallocated transactions)
   - `POST /leanfin/accounts/{id}/unarchive` — Unarchive account
+  - `/leanfin/accounts/indexa/link` — Link Indexa Capital accounts (GET selection form, POST submit)
   - `/leanfin/accounts/manual/new` — Create a manual account (GET form, POST submit)
   - `/leanfin/accounts/manual/{id}/edit` — Edit manual account metadata (GET form, POST submit)
   - `/leanfin/accounts/manual/{id}/value` — Record a new value for a manual account (GET form, POST submit)
@@ -145,7 +147,7 @@ After login, the top-level router serves:
   - `/leanfin/expenses` — Expenses page (multi-label selector + chart + transaction list)
   - `/leanfin/expenses/chart?label_ids=1,2&days=90` — Expense chart data (HTMX)
   - `/leanfin/labels` — Label CRUD
-  - `/leanfin/settings` — Enable Banking credentials management (GET form, POST multipart)
+  - `/leanfin/settings` — Enable Banking credentials and Indexa API token (GET form, POST multipart)
 - `/voice/` — VoiceToText sub-app (nested router)
   - `/voice/` — Job list dashboard (auto-polls for status updates via HTMX)
   - `/voice/new` — Upload form + browser mic recording (MediaRecorder API)
@@ -421,6 +423,91 @@ myapps cron
   └─ Log summary: "Synced 42 new transactions across 3 accounts"
 ```
 
+## Indexa Capital Integration
+
+LeanFin tracks investment accounts held at Indexa Capital (depositary:
+Cecabank). PSD2 covers payment accounts, not securities/custody accounts, so
+Enable Banking cannot see these — before this integration they could only be
+tracked as manual accounts with hand-entered values.
+
+### Per-User Token
+
+Indexa uses a long-lived **personal API token**, generated by the user in
+Indexa's private area (Ajustes → Aplicaciones) and sent as the `X-AUTH-TOKEN`
+header. It is read-only (no trading) and covers every account the user holds or
+co-holds. The token is stored per user in `leanfin_user_settings.indexa_token`,
+encrypted at rest with AES-256-GCM using the same `ENCRYPTION_KEY` scheme as the
+Enable Banking private key.
+
+Unlike a PSD2 consent, the token does not expire. Indexa accounts therefore use
+a far-future `session_expires_at` sentinel (`9999-12-31`) and never surface
+re-authorization prompts.
+
+### Endpoints Used
+
+| Endpoint | Purpose |
+|----------|---------|
+| `GET /users/me` | List linkable accounts (link flow only) |
+| `GET /accounts/{n}/portfolio` | Current valuation — the only call the routine sync makes |
+| `GET /accounts/{n}/performance` | Daily valuation history, for the one-off backfill at link time |
+
+### Personal Data
+
+`GET /users/me` and `GET /accounts/{n}` embed the user's postal address, email
+and national ID document numbers, despite Indexa's documentation stating the API
+excludes personal data. Consequently:
+
+- Neither response is written to `leanfin_api_payloads`.
+- The routine sync never calls either endpoint.
+- Response structs deserialize only the fields LeanFin needs; serde discards the
+  rest.
+
+`/portfolio` and `/performance` carry no personal data and are payload-logged as
+usual, under `provider = 'indexa'`.
+
+### Account Linking Flow
+
+1. User saves an Indexa API token at `/leanfin/settings`.
+2. User opens `/leanfin/accounts/indexa/link`. (Without a token they are
+   redirected to settings.)
+3. The app calls `GET /users/me` and renders the linkable accounts as
+   `acct_{number}` checkboxes. Account numbers already linked are shown as such.
+4. `POST /leanfin/accounts/indexa/link` re-fetches the account list and accepts
+   only numbers the token actually owns, then inserts rows with
+   `account_type = 'indexa'` and `account_uid = <account_number>`.
+5. The full valuation history is backfilled from `performance.portfolios[]`,
+   which reaches back to account opening. PSD2 offers 90 days at best.
+
+### Sync Job Flow (cron)
+
+Indexa accounts sync independently of Enable Banking — a user with only Indexa
+accounts needs no Enable Banking configuration at all.
+
+```
+myapps cron
+  │
+  ├─ (Enable Banking bank accounts — see above)
+  │
+  └─ For each user with account_type = 'indexa', archived = 0:
+      ├─ Decrypt the user's Indexa token (skip user if absent)
+      │
+      └─ For each Indexa account:
+          ├─ GET /accounts/{n}/portfolio
+          ├─ UPDATE leanfin_accounts.balance_amount (currency EUR)
+          └─ Record balance snapshot (balance_type = 'INDEXA', end-of-day
+             timestamp from the portfolio's own valuation date)
+```
+
+There is no reconciliation step: Indexa reports a valuation, not a running
+balance with transactions to reconcile against.
+
+### Balance Series
+
+Indexa accounts have balance snapshots but no transactions, so
+`get_balance_series` routes every non-bank account type through the
+snapshot-with-gap-filling path. The bank path reconstructs balances by walking
+transactions backwards from a snapshot and would yield nothing here.
+
 ## Deployment
 
 See [deployment.md](deployment.md) for detailed instructions.
diff --git a/docs/requirements.md b/docs/requirements.md
index 78d6bae..a744cda 100644
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -59,6 +59,26 @@ visibility into spending patterns.
 - When a bank consent expires (or is close to expiry), the system notifies the
   user so they can re-authorize.
 
+### Investment account integration (LeanFin)
+
+- Connect **Indexa Capital** accounts using a personal, read-only API token
+  generated in Indexa's private area. The token grants access to every account
+  the user holds or co-holds, and does not expire — unlike a PSD2 consent, an
+  Indexa account never needs re-authorization.
+- Indexa accounts hold their assets at a depositary (Cecabank) as securities
+  accounts, which PSD2 does not cover — Enable Banking cannot see them. Before
+  this, they could only be tracked as manual accounts with hand-entered values.
+- A daily cron job records the portfolio valuation as a balance snapshot; the
+  manual sync button triggers the same update.
+- Linking an account backfills its entire valuation history, which reaches back
+  to the account's opening date, so the balance chart is populated immediately.
+- The accounts page gains an "Indexa Capital" section alongside "Bank Accounts"
+  and "Manual Accounts". Indexa accounts appear in the balance evolution chart
+  and the "All accounts" aggregate like any other account.
+- Indexa's `/users/me` and `/accounts/{n}` responses contain personal data
+  (postal address, email, national ID). LeanFin never logs those payloads and
+  the routine sync never requests them.
+
 ### Transaction management (LeanFin)
 
 - Transactions are stored locally and deduplicated by their external ID
@@ -142,6 +162,14 @@ visibility into spending patterns.
 - Enable Banking API uses self-signed JWTs (RS256) for authentication. Private
   keys are stored per-user in the database, encrypted at rest with AES-256-GCM
   using a server-side encryption key.
+- Indexa Capital API tokens are stored per-user with the same AES-256-GCM
+  encryption. They are never rendered back to the browser, never logged, and
+  never written to the API payload log.
+- **Output escaping** — user-controlled strings (account names, label names) and
+  provider-supplied text (transaction descriptions, counterparty names) are
+  HTML-escaped before interpolation into server-rendered templates, via the
+  shared `myapps_core::components::html_escape`. It escapes both quote
+  characters, so it is safe in element bodies and in quoted attributes.
 - No secrets are committed to the repository.
 
 ### CI/CD
@@ -223,9 +251,10 @@ visibility into spending patterns.
   crypto). Manual accounts support CRUD operations (create, edit metadata, update
   value with date, delete). Values are recorded as daily balance entries with
   carry-forward gap filling for sparse updates. The accounts page is split into
-  "Bank Accounts" and "Manual Accounts" sections. Balance evolution charts and
-  the "All accounts" aggregated view include manual accounts seamlessly. The sync
-  process filters to bank accounts only, skipping manual accounts. Users can
+  "Bank Accounts", "Indexa Capital" and "Manual Accounts" sections. Balance evolution charts and
+  the "All accounts" aggregated view include manual accounts seamlessly. The
+  Enable Banking sync process filters to bank accounts only, skipping manual
+  accounts (Indexa accounts sync through their own provider). Users can
   bulk-import historical balance data from CSV files (two-column format:
   date + value) with all-or-nothing validation and idempotent upserts.
 - **Expense visualization** — a dedicated Expenses page with multi-label
diff --git a/docs/screenshots/form-input-inputs.png b/docs/screenshots/form-input-inputs.png
index 141643e..7e704cf 100644
Binary files a/docs/screenshots/form-input-inputs.png and b/docs/screenshots/form-input-inputs.png differ
diff --git a/docs/screenshots/form-input-row-editing.png b/docs/screenshots/form-input-row-editing.png
index bd70f57..0d4c277 100644
Binary files a/docs/screenshots/form-input-row-editing.png and b/docs/screenshots/form-input-row-editing.png differ
diff --git a/docs/screenshots/form-input-view.png b/docs/screenshots/form-input-view.png
index 9e1d7c8..8c2f231 100644
Binary files a/docs/screenshots/form-input-view.png and b/docs/screenshots/form-input-view.png differ
diff --git a/docs/screenshots/leanfin-accounts.png b/docs/screenshots/leanfin-accounts.png
index 8c66248..c29ce16 100644
Binary files a/docs/screenshots/leanfin-accounts.png and b/docs/screenshots/leanfin-accounts.png differ
diff --git a/docs/screenshots/leanfin-balance.png b/docs/screenshots/leanfin-balance.png
index 040f8e8..863e541 100644
Binary files a/docs/screenshots/leanfin-balance.png and b/docs/screenshots/leanfin-balance.png differ
diff --git a/docs/screenshots/leanfin-expenses.png b/docs/screenshots/leanfin-expenses.png
index 87b324e..8aa93ca 100644
Binary files a/docs/screenshots/leanfin-expenses.png and b/docs/screenshots/leanfin-expenses.png differ
diff --git a/docs/screenshots/leanfin-transaction-details.png b/docs/screenshots/leanfin-transaction-details.png
index 4802645..5ff56af 100644
Binary files a/docs/screenshots/leanfin-transaction-details.png and b/docs/screenshots/leanfin-transaction-details.png differ
diff --git a/docs/screenshots/leanfin-transactions.png b/docs/screenshots/leanfin-transactions.png
index 4244438..e108c56 100644
Binary files a/docs/screenshots/leanfin-transactions.png and b/docs/screenshots/leanfin-transactions.png differ
diff --git a/docs/screenshots/mindflow-inbox.png b/docs/screenshots/mindflow-inbox.png
index 320cd8b..f9f3fd0 100644
Binary files a/docs/screenshots/mindflow-inbox.png and b/docs/screenshots/mindflow-inbox.png differ
diff --git a/docs/screenshots/mindflow-map.png b/docs/screenshots/mindflow-map.png
index ce360e2..3d88687 100644
Binary files a/docs/screenshots/mindflow-map.png and b/docs/screenshots/mindflow-map.png differ