Encryption

In transit#

Every connection uses HTTPS: your browser to Cloudflare, and Cloudflare to the server through an encrypted tunnel. The same goes for the Sync extension and AI assistants.

At rest#

The database, the app’s own secrets and its swap space live on an encrypted volume (LUKS2, AES-256). The key isn’t stored on the server. When the server restarts, the volume stays locked and the app stays off until our deployment system, which holds the key, unlocks it. A copy of the disk, an old drive, or a snapshot taken at the provider is unreadable without the key.

A few especially sensitive things get an extra layer on top:

• Passwords are stored only as a salted hash, never the password itself.
• API tokens and invite links are stored as hashes, so a token can’t be read back once it’s made.
• Two-step sign-in secrets and backup codes are encrypted inside the database.
• Price-feed keys you add for share prices are encrypted inside the database.

In backups#

Each nightly backup is encrypted on the server before it’s uploaded, with age. The server only has the public half of the key. The private half, the only way to open a backup, is kept offline. Someone who got into the backup storage, or even the server, couldn’t read old backups. See backups.

What encryption doesn’t do#

Budget Smugglers isn’t end-to-end encrypted. The server has to read your transactions to categorise them, total your budgets, project your loan and draw your charts. End-to-end encryption would mean doing all of that in your browser, which would make the app slow and stop the forecasts, alerts and emails from working.

So while the app is running, the data is readable on the server. That’s why the rest of this section matters: the server is locked down, nobody looks inside your account without your pass, and every change is in the audit log.