Security
Protected at every layer.
Finaura is designed so your financial data stays where you control it. Your device. No centralized financial database. No Finaura account holding your information.
Security starts with where your data lives.
There's no account database to breach and no financial records sitting on a Finaura server. Everything below protects data that already never leaves your device.
Local storage
Your financial records - transactions, budgets, accounts, and goals - live in your browser's IndexedDB. Nothing is written to a Finaura server, because there isn't one.
Authentication
Unlock with a PIN, a password, or - on supported devices - a fingerprint, Face ID, or a saved passkey.
Credential protection
Your PIN or password is never stored or transmitted in plaintext. It's hashed with PBKDF2-SHA-256, 600,000 iterations, and a random salt before it ever touches storage.
Recovery and backup
A separate recovery password resets a forgotten PIN without losing data. Because there's no server-side account, regular local backups are the safety net behind that.
Every layer, in detail
PIN / password lock
A 6-digit PIN or text password locks the app after inactivity.
Passkey / biometric unlock
One-tap Face ID, fingerprint, or saved passkey on supported devices.
Two-factor (TOTP)
Standard authenticator app support - Google Authenticator, Authy, and others.
Rate limiting
A 30-second cooldown after 5 failed unlock attempts slows brute-force guessing.
Recovery password
Hashed the same way as your PIN; resets access without a server round-trip.
Local data storage
Transactions, budgets, and accounts live in IndexedDB on your device only.
Export / restore
A full JSON export you control, usable to back up or move to a new device.
Optional Drive sync
Google Drive sync is opt-in and goes to your own Drive, never Finaura's.
Privacy means responsibility too.
Because Finaura doesn't hold your account or credentials, there is no central reset button. If both your unlock credentials and recovery password are lost, your local data cannot be recovered. That's why regular backup is recommended.
What Finaura uses
PBKDF2-SHA-256
The algorithm that turns your PIN or password into a stored hash - slow by design, to resist brute-force attacks.
Random salts
A unique random value mixed into every hash, so the same PIN never produces the same stored value twice.
TOTP
Time-based one-time codes from a standard authenticator app, for an optional second unlock factor.
WebAuthn / Passkeys
The browser standard behind biometric and passkey unlock - your fingerprint never leaves your device.
IndexedDB
The browser database Finaura stores your financial data in, sandboxed to your device.
HTTPS
Encrypts the app itself in transit when it loads - it never carries your financial data anywhere.