Security & privacy
Financial data is among the most sensitive data there is. That is why Rehluchs Finance follows the zero-knowledge principle: the server can store your data but cannot read it.
End-to-end encryption in your browser
As soon as you enter something, your browser encrypts it with AES-256-GCM. Only then is it sent to the server. Without your key the stored data is just random-looking characters.
Your password never leaves your device
Two values are derived from your password in the browser (PBKDF2-SHA256 with 600,000 iterations): an encryption key that never leaves your device, and a login proof that the server additionally protects with scrypt and a secret pepper.
Recovery without a back door
Instead of a “forgot password” email there is a recovery key that only you know. There is no back door for the operator.
Share safely with your family
Family vaults have their own key, encrypted for each member with their public key (ECDH P-256). A security code helps you verify that you invite the right person.
Protection against tampering
Every entry is cryptographically bound to its place. If someone swaps or alters data on the server, the app detects it and hides those entries.
Hardened server in Germany
HTTPS, strict content security policy, protection against CSRF and brute force, separated database permissions and a sandboxed service. No tracking, no ad networks, no external fonts.
What the server sees – and what it doesn't
Visible to the server
- Email address
- Sign-in times
- Number and type of entries (e.g. “transaction”)
- Who shares a family with whom
🔒 Readable only by you
- Your password
- Amounts and balances
- Descriptions, categories and notes
- Savings goals, family names and bank transactions
To be honest
No software is 100% secure. Whoever takes over the running server could in theory deliver modified code – that applies to every web app. That is why the server is additionally hardened and kept up to date.