Your account is protected by magic-link sign-in: there's no password, so there's nothing to guess, leak, or reuse somewhere else. Each link is sent to your email address and works once.
Your data is encrypted the whole way. It's scrambled while it travels between your device and helloBill, and scrambled again while it's stored. Your bank details get an extra layer: the keys that unlock them are held in dedicated hardware security modules, kept separate from the data itself.
If anything ever looks wrong with your account, email [email protected] and a real person will look into it.