Security Architecture
The strongest thing that can be said about our security is not a certification. It is that your financial data is encrypted on your own device under a key we never receive, so there is no server-side copy to breach, subpoena or leak.
AES-256 Encryption
Financial records are encrypted at rest in IndexedDB with AES-256-GCM. The key is derived from your PIN using PBKDF2-SHA256 and lives in memory only, never on disk.
Local-First Vault
Your data stays on your device. There is no tier that changes this, and no server-side copy for anyone — us included — to reach.
Zero-Knowledge
We cannot read your records, and this is a property of the design rather than a promise about our conduct. The key never leaves your browser, so there is nothing for us to be trusted with.
Almost No Server
Nothing of yours is synced. Our servers hold published market rates, request logs, and — only if you create one — an encrypted CA bundle that is deleted on its expiry date.
Data Lifecycle
Our architecture ensures that data only exists where it's absolutely needed for the shortest time possible.
Step 1: Local Input
When you enter data into a calculator, it is processed locally in your browser. Calculations are executed client-side using our optimized Math Engines.
Step 2: Encrypted at Rest
Data is written to local storage (IndexedDB) encrypted with AES-256-GCM, under a key derived from your PIN and held only in memory. This applies to everyone — there are no tiers, and there is no synchronization for it to be encrypted ahead of.
Step 3: Only What You Send
There is no cloud sync, so for almost everyone step 3 does not happen at all. When you deliberately use a feature that transmits — sharing a bundle with your accountant, asking the AI a question with your own key, backing up to your own Drive — it travels over HTTPS, and bundles are encrypted on your device before they leave it. This step used to claim our servers received an encrypted blob of your data. They receive no blob, because no sync exists.
Safeguards and Breach Duty
Section 8(4) of the DPDP Act, 2023 requires reasonable security safeguards to prevent a personal data breach. Ours are the ones described above, plus HSTS and a strict Content-Security-Policy naming every origin the app may contact. If a breach affects anything we hold, section 8(6) requires us to notify the Data Protection Board of India and every affected person — and we will.
This panel previously displayed a "SOC 2 — Aligned" badge and claimed regular internal audits and penetration testing. Trezoriq holds no SOC 2 attestation and no audit or pen-test programme exists, so both have been removed. A security page that overstates its assurances is itself a security problem.
Security updated for September 7, 2026