Security

This page is about how Finyvo is built underneath. The privacy policy answers what data of yours is handled, what for, and with whom; this is the how: where each thing lives, what protects it, which decisions we made, and which ones we haven’t made yet. No seals, no superlatives.

The short version

Question	Short answer
Where does your financial data live?	On your iPhone and, if you leave sync on, in the private database of your own iCloud account. On no server of ours
Is there an account or password?	No. The app identifies itself with a cryptographic key that is born inside your iPhone’s Secure Enclave and never leaves it
What protects the traffic?	HTTPS with TLS 1.2 or later, on every connection
Where does the backend run?	On Cloudflare Workers, with D1 and KV as its only storage
Where are the providers’ keys?	Only on the backend, as Cloudflare secrets. None of them ships inside the app
Can you turn off what goes out to the internet?	Yes. iCloud sync and the artificial intelligence features each have their own switch
Any security certifications?	No. No SOC 2, no ISO 27001. The detail is in What isn’t there yet

On your iPhone

Almost all of Finyvo happens on your device. The database, the calculations, the budgets, the reports, the export: none of that needs a server.

The database. Your transactions, wallets, categories, tags, budgets, goals, and subscriptions live in SwiftData, Apple’s local storage framework, which is SQLite underneath. The files sit inside the App’s container with iOS data protection, in the NSFileProtectionCompleteUntilFirstUserAuthentication class: if your iPhone has a passcode, they are encrypted at rest until the first unlock after powering on.

The preferences. Language, theme, preferred currency, private mode, and the state of the artificial intelligence switches are stored in UserDefaults, the system’s settings store. Nothing financial goes there.

The Keychain. We store exactly two things there, and neither one is data about you:

What	Accessibility class	What it means in practice
App Attest key identifier	kSecAttrAccessibleWhenUnlockedThisDeviceOnly	Readable only while the iPhone is unlocked, and only on this device
Backend session token (15 minutes)	kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly	Readable after the first unlock since you powered the phone on, so the app can do its background work — rescheduling alerts, refreshing rates — without waiting for you to unlock it. Also only on this device

Neither is marked as synchronizable: they do not travel to the iCloud Keychain and are not restored on another device. By iOS design, Keychain items can survive uninstalling the app; they are removed when you reset the device.

The private key isn’t in that table, because we don’t have it. It lives inside the Secure Enclave, the iPhone’s security coprocessor. Neither the App nor we can read it — we can only ask it to sign. What we keep in the Keychain is its identifier.

The backups. Before every internal format change to the database, the App saves a copy inside its own container and keeps up to 7, rotating. They are local: they are not uploaded to any server of ours. If a format update fails, the app restores the latest copy on its own and tries again; you can also pick one by hand in Settings → Advanced zone → Restore from backup.

Private mode, and how far it goes. The eye icon on the Home screen hides every amount at once, including what VoiceOver reads out loud. It is a visual control: it does not encrypt anything and does not lock access to the app. Finyvo does not include Face ID, Touch ID, or passcode locking; the iOS passcode is the only door today.

Your iCloud copy

If you leave sync on — it is on by default — your data is replicated to the private database of your own iCloud account, inside the iCloud.com.moiszr.finyvo container. That is Apple’s infrastructure and the account is yours: Apple encrypts it in transit and at rest, and Finyvo cannot query it. It does not appear in any console of ours. If you have Apple’s Advanced Data Protection enabled, that copy is additionally end-to-end encrypted.

You can turn it off in Settings → Sync → iCloud. The change applies the next time you open the app, and with it off your financial data does not leave the device.

Turning it off does not delete what was already uploaded. The App has no “delete my iCloud copy” button: to remove it you go to iOS Settings → [Your name] → iCloud → Manage Account Storage → Finyvo.

Exactly what gets replicated, and what happens with your display name, is in the privacy policy.

How the app authenticates

Finyvo has no accounts. There is no email, no password, no login for anyone to guess, leak, or steal from you. The backend checks something different: that the caller is the real app, running on a real device.

The key. On first launch, the App generates a cryptographic key inside the Secure Enclave. The private half never leaves that chip: the app can’t read it, iOS can’t, and neither can we. It can only be asked to sign.

The handshake, step by step:

1. The app requests a challenge from /auth/challenge. The backend returns a random number that is single-use, with a 5-minute lifetime.
2. The app asks the Secure Enclave for an attestation over that challenge and sends it to /attest/verify. This is where Apple comes in: the attestation proves the key was born on a real device and that whoever is using it is a legitimate copy of Finyvo.
3. If it checks out, the backend burns the challenge — a used one is never accepted twice — and issues two things: an installation identifier and a session token that expires after 15 minutes.
4. From then on, every call to /fx/*, /brand/*, /ai/*, and /import/* travels with that token. No feature of the App uses a shared anonymous token.
5. When the token has a couple of minutes left, the app renews it on its own: new challenge, new Secure Enclave signature, new token. If a request crosses the expiry and comes back 401, it renews and retries once.

The key that is inside the binary. The three handshake requests cannot carry a session token yet — they exist to obtain one — so they identify themselves with an application key shipped inside the binary and therefore common to every copy of Finyvo. Anyone who extracts the binary can read it, which is why it is not the security boundary: it filters out background noise. The real boundary is the Secure Enclave attestation, which cannot be forged by copying a string. That key does not identify you either.

The simulator. App Attest does not exist in the Xcode simulator, so development builds have a shortcut to skip it. That shortcut does not ship in the App Store binary, and the backend only accepts it when a development secret is configured, which in production it is not.

What the installation identifier is. It is pseudonymous and persists for as long as the app stays installed; the backend uses it to count your monthly artificial intelligence quota, resolve whether you have Finyvo Plus, and block abuse. What it means as personal data, and what it is cross-referenced with, is explained in the privacy policy.

In transit

Everything travels encrypted with HTTPS / TLS 1.2 or later: between the App and our backend, and between our backend and external providers. There is no plaintext path.

Our backend requires TLS and always responds with these headers:

Header	Value	What it’s for
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload	A year of mandatory HTTPS, subdomains included
Content-Security-Policy	default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'	The API does not serve pages: it can’t load resources, be embedded, or submit forms
X-Frame-Options	DENY	The same, for older browsers
X-Content-Type-Options	nosniff	Nobody reinterprets a response’s type
Referrer-Policy	no-referrer	No address of ours leaks outward
Permissions-Policy	geolocation=(), microphone=(), camera=()	The API asks for no sensors, and it is written down
Cross-Origin-Resource-Policy / Cross-Origin-Opener-Policy	same-site / same-origin	Isolates responses from other origins
Cache-Control	no-store	Nothing is kept in intermediate caches. The exception is brand logos, which are public and are cached

The finyvo.com site installs no cookies and loads no third-party resources: the fonts are hosted on our own domain.

How the backend is built

api.finyvo.com runs on Cloudflare Workers: code that executes at the edge of the network, in the data center closest to you. There is no machine of ours running anywhere, and therefore no server to patch, no open port to watch, and no disk where things pile up through neglect.

The backend does two jobs: proxy to external providers and gatekeeper for the paid features.

Everything that persists fits in two services, and neither one holds financial information of yours:

Where	What it stores
Cloudflare D1 (SQL database)	Historical exchange rates, the installation registry, and technical artificial intelligence usage metrics: which feature, which model, how many tokens, how long it took, and whether it succeeded
Cloudflare KV (key-value)	Caches for rates, symbols, and brand lookups, the handshake challenges, and the rate-limit counters. All with automatic expiry

Cloudflare encrypts at rest what it stores in D1. Outside of D1 and KV, the Workers have no persistent storage.

The body of artificial intelligence requests is not stored. Neither the request nor the response. All that remains is the technical metric in the table above.

External providers’ keys live only here, as Cloudflare secrets: the exchange-rate provider’s, Brandfetch’s, and the language-model provider’s. None of them ships inside the App or is handed to the client in any response. That is precisely why the backend exists as a proxy instead of the app calling each provider directly: a key embedded in an app installed on thousands of phones is a published key.

Operational logs — route, status code, duration, request identifier — are retained by Cloudflare for up to 30 days and are not exported to any other service of ours. Which personal data can appear in them, and for how long, is detailed in the privacy policy.

Internal health alerts are sent through ntfy with operational metadata: status code, route, request identifier, and counters. The IP address is not sent to that service, and that is a design decision, not a coincidence.

Limits and anti-abuse

Limits exist so that abuse can’t take the service down or blow up a provider’s bill. Today they are these:

Limit	Scope
60 requests per minute	Per IP address, across the API routes
10 requests per minute	Per IP address, on /attest/verify only — the most expensive step of the handshake
10 requests per minute	Per installation, on /import/*

/health and non-API routes are exempt: the automated scanners that prowl any public domain don’t consume counters.

There are no per-token limits anymore. They went away with App Attest: when the app used a shared static token, the limit belonged to the token rather than to the caller, so it measured nothing useful.

When something goes over the line, the answer is a 429 with the Retry-After and X-RateLimit-* headers, so the client knows how long to wait. And if the counter store goes down, the limiter lets requests through instead of blocking: between a failure of ours leaving you without exchange rates and a minute of requests going uncounted, we pick the second.

Separate from all this, and different: the free plan’s monthly artificial intelligence quota, which the backend counts per installation. That is a plan limit, not a security one; it is described in the privacy policy.

The switches are yours

Two things send data off your device, and both can be turned off in Settings:

• iCloud sync — Settings → Sync → iCloud. With it off, your financial data does not leave the iPhone. The change applies at the next launch.
• Artificial intelligence — Settings → Artificial intelligence. One master switch and five per-feature ones. With the master off, no artificial intelligence call goes out, including the ones in the file import flow. The App falls back to its local engines, which work offline, and import goes straight to manual column mapping.

Two warnings about when that data leaves:

• Artificial intelligence categorization fires when you leave the description field, before you save. If you type a description and then cancel the transaction, that text and that amount have already been sent.
• Whatever you name a subscription is used as-is to look up its logo, and it leaves your device inside the request address. Don’t put personal data, or other people’s data, in there. You can change it any time from the editor.

The way out. Settings → Data → Export my data generates a ZIP with your complete data inside the iPhone: offline, without passing through any server, and without needing Finyvo Plus. That file comes out unencrypted and without a password: the moment you share it or save it outside the app, it stops being protected by the App’s container. Keep it somewhere safe.

Deletion. Settings → Advanced zone → Reset all data empties the App’s database. Note that this does not by itself remove the iCloud container: that is what the system settings above are for.

What isn’t there yet

Finyvo is built by one person. Here is what it does not have today, stated as precisely as what it does:

• Certifications. We have no SOC 2, no ISO 27001, and no equivalent seal. Those audits are designed for companies that hold their customers’ data on their own servers; Finyvo does not hold yours — it lives on your iPhone and in your iCloud. If that model ever changes, this page will say so first.
• External audit and bounty program. We do not publish a pentest report and we have no bug bounty program. The channel for reporting is right below, and it is read.
• In-app locking. There is no Face ID, Touch ID, or app passcode. If someone has your iPhone unlocked, they can open Finyvo.
• Encrypted export. The export ZIP comes out in the clear.
• Deleting your iCloud copy from the app. That button does not exist; it is done from iOS settings.
• Keychain items after uninstalling. By iOS design they can survive uninstalling. They are two technical credentials, not data about you, and they are removed when you reset the device.

When any of these changes, this page changes with it.

Reporting a security issue

If you find something — in the app, in the backend, or on the website — write to [email protected] with Security as the subject.

Tell us what you found and how to reproduce it. If you can, include the app version and the approximate time: it helps locate the request in the logs, which only live for 30 days.

What we ask of you: give us time to fix it before publishing, and don’t access other people’s data or degrade the service while you investigate. There is no monetary reward; there is public credit here, if you want it.

We reply within 30 calendar days at most, the same commitment we apply to any privacy request.