Venova uses zero-knowledge encryption so your financial data stays private. In advanced mode, even we cannot read it. No compromises.
Every architecture decision in Venova starts with a simple question: does this protect the user's data?
Your data is encrypted on your device before it ever reaches our servers. In advanced mode, even we cannot decrypt it. Your keys, your data.
On the Free plan your records stay on your own device, and no account is needed. They reach the cloud only when you choose a paid plan and sign in. You control where your data lives.
Revenue comes from subscriptions, not your data. No tracking pixels, no behavioural profiling, no third-party data sharing. Ever.
Every document is compressed and encrypted on your device before it is transmitted. Here is the cryptographic stack.
Venova offers two encryption modes so you can balance convenience with maximum privacy.
Your data encryption key is also wrapped under a server-side recovery key. If you forget your password, you can reset it and recover your data. The server uses that key to restore your access, which means it is technically capable of decrypting your data. It does nothing else with it.
The server-side recovery wrap is removed. Only your password (or your recovery code) can decrypt your data. We cannot access it under any circumstances, including password resets. It covers all of your records, including anything you import from a bank. The one exception is the copy of your bank data that Plaid sends to our servers on Premium, explained below.
Turn it on in Venova's Settings, and signing in asks for a 6-digit code from an authenticator app on your phone as well as your password. A stolen password alone cannot open your account.
Turn it on in Venova's Settings, under Security & privacy, and Venova asks for the check you unlock your device with before it shows anything: Touch ID or your password on a Mac, your fingerprint, face or screen lock on Android.
What leaves your device depends on your plan and whether you sign in, not on which device you use. The desktop, web and Android apps all follow the same rules.
On every plan: no analytics, no usage tracking and no advertising. The app sends a diagnostic report only when you choose to send one.
It depends on your plan, not on your device. On Free without an account, your records stay on your device, and the desktop app sends us only a check for updates when it launches. With a free account we also hold your email address, a log of your sign-ins, and your household's encryption keys, but none of your records. Base syncs your records to the cloud as ciphertext. Premium adds the bank data Plaid sends us, which we hold in readable form only until it is safely in your encrypted records, you skip it, or it goes 25 months without review, and never after you disconnect the bank. What you import from it into your records is encrypted. We never use any of it for analytics or marketing.
Your password is run through PBKDF2-SHA256 with 600,000 iterations to derive a key encryption key (KEK). That KEK wraps your ECDH private key, which in turn unwraps the data encryption key (DEK) via a key exchange protocol. Your data is encrypted with AES-256-GCM before it ever leaves your device. In advanced mode, the server has no copy of your keys and cannot decrypt your data.
In recoverable mode (the default), your data encryption key is also wrapped under a server-side recovery key, so we can help you regain access if you forget your password. In zero-knowledge mode, that server wrap is removed entirely: only your password or your recovery code can decrypt your data. We recommend starting with recoverable mode and switching to zero-knowledge once you have your recovery code safely stored.
At any time. You can export all your data as JSON, or your transactions as CSV, from the settings page. Closing your account removes your cloud-stored data; a few records outlive it, and the privacy policy lists them.
Never. We do not sell, rent, or share your financial data with anyone. Four providers support the service: Supabase stores your account and your encrypted records, Cloudflare hosts and delivers the app, Stripe handles subscription billing, and Resend delivers account emails. None of them can read your encrypted records. On Premium, Plaid connects your banks under its own privacy policy.
The desktop app stores everything in a local database, so it works without a connection. On Base or Premium it syncs on its own once you are back online: changes are compressed and encrypted before leaving your device and merged with your cloud account. Where the same record changed in two places, the most recent change wins.
If you are on Base or Premium and have synced at least once, your data is safely stored in our encrypted cloud. You can sign in on any device and pick up where you left off. On Free your records live only on that device, so keep regular exports as backups. In zero-knowledge mode, your password still unlocks your data on a new device. You need your recovery code only if you have also forgotten your password. If you turned on the app lock, Venova asks for Touch ID or your Mac's password on a Mac, or your fingerprint, face or screen lock on Android, before it opens. It locks the app, and does not encrypt the data stored on your device.