Security

How the encryption works

• When you set up your portfolio, your iPhone generates a 256-bit encryption key and stores it in the device keychain. It is marked device-only and non-syncable, so it is not copied to iCloud and not restored onto another device from a backup.
• Your holdings, purchase lots, prices, dates, watchlist and questionnaire answers are gathered into one structure and encrypted with AES-256-GCM before anything is sent.
• What reaches our servers is a single block of unreadable bytes per account, plus a counter used to stop two devices overwriting each other.
• Every decryption is authenticated. If a stored block were altered by even one bit, your app would reject it rather than show you something wrong.
• Portfolio value, gains, dividend estimates and projections are computed on your device from your own records, using decimal arithmetic rather than floating point, and are never transmitted.

Your recovery code

• Because the key lives on your device, a new device needs a way in. That way is a recovery code your iPhone generates — 25 characters, machine-generated, never chosen by you and never seen by us.
• Your device uses that code to wrap a copy of your encryption key. We store only the wrapped bytes and the public parameters needed to unwrap them; without the code they cannot be unwrapped, including by us.
• Synchronisation is not switched on until you have been shown the code and typed it back, so a portfolio is never quietly protected by something you did not save.
• After you confirm it, the code is never shown again unless you deliberately generate a new one, which requires unlocking your device with Face ID, Touch ID or your passcode.

What our administrators can and cannot access

This is enforced by the database itself, not only by our code. The internal dashboard we use to see how Raqib is doing connects with a database role that has no permission to read the tables holding encrypted portfolios or recovery material — the database refuses those queries outright. That dashboard has no user search, no per-user page, and no way to view an individual account.

On your device, and offline

• Your device keeps an encrypted copy of your portfolio so the app works without a connection. That local copy is in the same unreadable format we store, protected further by iOS file encryption.
• Edits made offline are saved immediately and synchronised when you are back online. Nothing is lost if the connection drops mid-change.
• If you edit on two devices before they sync, your device decrypts both versions locally and asks what to keep, defaulting to keeping everything from both. Our servers never merge anything, because they cannot read either version.
• Signing out removes the encryption key and the local copy from that device.

How we check that this is true

These are not just design intentions. Our automated tests encrypt a portfolio containing unique marker values, store it the way the real app does, and then search for those markers everywhere they could leak — every table and column in the database, a real database dump, the server logs, and the contents of every network request. The suite fails if a marker is found anywhere, and it also fails if a retired endpoint that once handled plaintext portfolios ever reappears in the app.

What this looks like in the app

The recovery-code screen from a development build. It states the trade-off before synchronisation is enabled.

Reporting a security concern

If you believe you have found a vulnerability, please write to us with enough detail to reproduce it, and give us a reasonable opportunity to fix it before publishing. We will confirm that we received your report.