Security model

Budvo is built so that your financial data stays on your hardware, encrypted at rest, and readable only after you unlock it. This page explains how, and where the limits are.

Who can see what

• You (and anyone you invite to your household) see your household's money in the dashboard and, later, the app.
• NullDaily sees none of it. There's no Budvo cloud holding your data. This website only publishes docs and releases, and the optional services described below never receive your financial data in readable form.
• Your server's host is you, unless a friend hosts you. See Hosting friends.

Full-database encryption

• The whole database file, and its journals, is encrypted with a random 256-bit data key (Adiantum), not just a few sensitive columns.
• The data key is never stored in plain form. keyring.json holds it wrapped twice with Argon2id and XChaCha20-Poly1305: once by your database password and once by your recovery key.
• Changing the password only rewraps the key. The database is never re-encrypted, so it's instant and safe.
• Connector credentials and two-factor secrets are encrypted again, field by field, inside the encrypted database.
• Backups are the encrypted file plus the keyring, so a stolen backup or disk is useless without the password or recovery key.

Locked after a restart

After any restart the server is locked: it can't read its own database until someone unlocks it with the password or recovery key in the dashboard. Someone who walks off with your NAS gets ciphertext.

While locked, reminders and syncs pause. A future option will let you opt in to auto-unlock for unattended restarts, with the key kept outside the data volume. The dashboard will explain the tradeoff plainly: anyone with both the disk and that key file could read the data.

Signing in

• Passwords are hashed with Argon2id, and sign-in is rate limited with lockouts.
• Two-factor with any authenticator app (TOTP), with one-time backup codes.
• Passkeys are coming for dashboards served over HTTPS on a real hostname. The iOS app will use a Face ID protected device key created during pairing, which gives the same protection bound to your phone.
• Sensitive actions (sign-ins, device pairings, exports, connector installs, deletions) are written to an audit log.
• Locked out with no one to reset you? Recover from the server with the database password or recovery key. Without one of them, recovery can't open anything.

Hosting friends

A server can hold several households: yours, and separate ones for friends you host. Every query is scoped to a household, and the host's admin screens never show another household's money.

Still, the host controls the machine and its database password, so they could technically read the data. Budvo says so plainly: before a friend finishes joining, they must acknowledge a notice that the host could see their data. Only join a server run by someone you trust.

Connectors and the marketplace

Connectors (for example Plaid, SimpleFIN or CSV import) are optional and run inside your server as sandboxed WebAssembly modules. They can only make HTTP requests to domains listed in their manifest and use their own storage and secrets. No filesystem, no database, no access to the dashboard.

Marketplace packages are reviewed and signed by NullDaily, and the server refuses unsigned ones unless you turn on developer mode. Budvo never ships provider keys: for Plaid, you bring your own, so your bank data flows between your server and the provider, never through us.

Notifications

Your server can't hold Apple's push keys, so push notifications for the iOS app will go through a small NullDaily relay. The server encrypts each notification with a key your phone created during pairing; the relay sees only a device token and ciphertext, and your phone decrypts it.

What the server sends out

• An update check to this website with the version it's running.
• Whatever the connectors you install need to talk to their providers.
• Encrypted pushes through the relay, once the app and reminders arrive.

That's all. There's no analytics and no telemetry unless a future version asks you to opt in.

Reporting a problem

Found a security issue? Email [email protected]. Please give us a chance to fix it before sharing details.