Security: who can see what?

How your vault is protected

Your assets, debts, monthly records, goals and settings live in one encrypted vault in your browser. A 256-bit key is derived from your vault password with Argon2id (64 MiB of memory, 3 passes) and the vault is encrypted with AES-256-GCM. Your password and key never leave your device.

• WebDAV connection details and AI API keys are inside the vault too.
• .wvlt backups you download and the Google Drive and WebDAV copies are encrypted the same way.
• Without your vault password or recovery code nobody, including us, can open the vault, which is why we cannot reset your password.

What our server and Cloudflare see

Novaulta runs on Cloudflare. Our server sees and stores your Google account ID, name, email, profile photo link, your sessions (with IP address and browser details), Google's access and refresh tokens (stored encrypted, with sign-in, email and profile permission only), short-lived request counters kept per IP address to limit abuse, the last backup method and time and a short-lived sync lock. It passes on the symbols and dates of Yahoo Finance and TEFAS price lookups; it does not link them to your account and keeps the shared answer briefly in the Cloudflare cache (a day for past closes).

• Our server does not receive your vault contents, your encrypted vault file, your vault password, your recovery code or your API keys.
• As the host, Cloudflare sees every request to novaulta.com and your IP address.
• The app's code is loaded from our server. If the server were compromised and served altered code, that code could read your data once you unlock the vault. This is true of every web app that runs in a browser. The content security policy (CSP) lets only our own scripts and Google's sign-in script run, which blocks scripts from other sites and injected scripts. It gives no protection if our server or deploy pipeline is compromised, because the same server sends the policy.

What Google sees

Google sees that you sign in to Novaulta with your Google account. If you choose a Google Drive backup, it sees the encrypted vault file, its size and when it changed in Drive's app data folder, but cannot read what is inside. If you choose Gemini as your cloud AI, it sees your question and the portfolio summary you chose to share.

What other services see

Exchange rate, metal price and inflation data providers get requests directly from your browser: they see your IP address and the currency, country or date asked for, not your portfolio. Your WebDAV server sees the encrypted vault file. The cloud AI provider you choose sees your question and the summary you chose to share in plain text. The full list is in the privacy policy.

If your device is stolen while the vault is locked

Whoever has the device finds the encrypted vault and unencrypted device settings such as the language, device ID and last fetched rates. To open the vault they have to guess your password. Argon2id slows down every guess but cannot protect a weak password, so choose a long vault password you do not use anywhere else.

• If “Keep unlocked on this device” is on, the vault opens in this browser without asking for the password, so whoever has the device and the browser profile can open it too. Turn it on only on a device that only you use and that has a screen lock.
• If your Google session is still signed in on this browser, they can use your account, but they cannot open your vault without the vault password.
• Someone who gets an encrypted backup file also has to guess the password. Old backups keep opening with the old password after you change it.

If your device is taken while the vault is unlocked

While the vault is unlocked, anyone using the device can see and change your records. By default the vault locks itself after 15 minutes without activity; you can change this on the Vault page. Browser extensions that can read web pages can also see the data in an unlocked vault.

Reporting a vulnerability

If you think you have found a security issue, write to the contact address in the imprint. Do not send your vault password, recovery code, API keys or financial data.