Security

Where your data is

PrivateACB keeps your portfolio in one database file on your computer, at the location you chose when you created it. Everything you import, every transaction record and every calculation run lives in that file. Reports go wherever you save them. The exchange files you import stay where you left them; the program reads them and does not move or upload them.

There is no account and no server-side copy. If you delete the database file, the data is gone; if you copy it to another computer with the program installed, it opens there with the same password.

The database

Encryption	SQLCipher, built into the program rather than taken from the system. The whole file is encrypted, page by page, with AES-256-CBC. Version 4.5.3 in the current release.
Your password	The key that encrypts the file is derived from your password with PBKDF2-HMAC-SHA512 at 256,000 iterations, SQLCipher's own default setting; every page also carries an HMAC-SHA512 tag, so a tampered file fails to open rather than opening wrong. The password must be between 8 and 256 characters. The program grades its strength as advice; it does not refuse a weak one.
While the database is open	The password stays in the program's Rust core for the session and is never handed back to the interface. Closing the database drops it.
Remembering the password	The open dialog offers to remember the password on this computer, and the box is ticked by default. A remembered password is encrypted by Windows for your Windows login (DPAPI) and kept in your user registry; the program cannot read it from another Windows account or another machine. It is a convenience with a cost: anyone who can sign in to your Windows account can open the database through the program. Untick the box, or use Forget in Settings, if that matters where you work.
Changing the password	Settings checks the current password first, re-keys the file in place, then proves the result by reopening the file with the new password before it reports success. If the change cannot complete, the program reopens the file with whichever password still works and tells you which one that is.
A lost password	Cannot be recovered. There is no back door and I hold no copy. Without the password the file is unreadable, to you and to anyone else, so keep it somewhere you trust.
Copies	Export Database Copy writes a compacted copy wherever you choose and opens it with your current password before reporting success. The copy is a full database, encrypted the same way, needing the same password. Copies you make yourself by copying the file are the same: encrypted, and only as safe as the password.

Everything else the program keeps on your computer

What	Where, and how it is protected
Price-source keys you enter	A CoinGecko or FRED key, if you add one in Settings. Encrypted with DPAPI for your Windows login, in your user registry. Deleting the key in Settings removes it.
Your license key and activation	The same DPAPI store. The record is tied to the machine, so a copied registry does not carry a license to another computer.
The trial clock	The 30-day trial is a start date written to the same DPAPI store with a checksum. It is local; the trial sends nothing anywhere.
The events table	A record of what the program did while the database was open, kept inside the encrypted database itself. Export Events writes it out as a CSV if you ask.
Session log files	Plain CSV files (timestamp, type, message) in the logs folder under PrivateACB in your Documents, one per session. The Session Logging switch in Settings controls them; a size cap rotates the file and, by default, files older than thirty days are deleted. They describe what the program did and any errors. Read one before you attach it to a bug report.
Reports	Plain PDF and CSV files wherever you saved them. They are not encrypted; they are the documents you asked for.

What crosses the network

Every connection the program makes is listed here, with what goes out and what comes back. Each one happens when you ask for something that needs it, never in the background. All of them are HTTPS.

Destination	When	What goes out	What comes back
CoinGecko api.coingecko.com	When you ask the program to fill in a coin's missing daily prices.	The coin's identifier and the dates. Your CoinGecko key, if you entered one.	Daily prices.
DefiLlama coins.llama.fi	For dates older than CoinGecko's free history covers.	The coin's identifier and the dates.	Daily prices in US dollars.
Binance api.binance.com	For coins the first two sources do not carry.	The trading pair and the dates.	Daily prices in US dollars. Binance refuses connections from the United States (HTTP 451); the program reports that and stops.
Bank of Canada www.bankofcanada.ca	When a price in US dollars has to be converted into your reporting currency.	The currency pair and the dates.	Daily exchange rates.
FRED (US Federal Reserve) api.stlouisfed.org	Only if you turned it on and entered a FRED key in Settings. Off by default.	The rate series, the dates and your key.	Daily exchange rates.
The license service privateacb-license.rjv-treepro.workers.dev	Once, when you enter a license key. Again only if you free the seat.	The key, a SHA-256 hash of your Windows machine identifier, your computer's name and the program version. Deactivation sends the key and the hash.	Whether the key is valid, its tier, and how many of its three seats are used.
Your browser	When you pick a Help menu item.	Nothing from the program. It asks Windows to open a page of this site, or the GitHub issues page, in your default browser.	A web page, in the browser.

Not on the list, because the program does not do them: checking for updates, sending crash reports, sending usage statistics, and connecting to an exchange. The program never talks to your exchange; it reads the files you export from it. Every price request names a coin and a date range, not you and not your holdings; if you would rather it asked nothing, import a price file or type the price and it stays offline.

The program you download

• The installer and the program are digitally signed in my name, Robert Vassov, through Azure Artifact Signing, with an RFC 3161 timestamp so the signature stays valid after the signing certificate rotates. Right-click the downloaded file, choose Properties, then Digital Signatures, and the signer should read Robert Vassov. A file that has been altered fails the check.
• Every release carries its SHA-256 on the download page and on the GitHub release. Compare it if you want a second check.
• There is no automatic update. The program never checks for a new version. When one is out, the changelog says what changed and you download it yourself.
• It is a native Windows program, written in Rust with the interface built on Tauri. The interface runs in the WebView2 component Windows already ships; there is no browser bundled inside the installer.

What the license service holds

The license service is a small program on Cloudflare. For each license key it keeps the tier, the email address from your order (so the key can be sent to you, and sent again if you lose it), and up to three activation records, each holding the machine hash, the computer name you activated from, the program version and two timestamps. Nothing about your portfolio ever reaches it, because the program never sends any.

This site records each download (time, version, country, region, city, referrer and browser, kept one year, without your IP address) and keeps contact-form messages for ninety days. The privacy policy has the retention table.

The outside services

Everything the program and this site depend on, in one list. The About page prints the same list from the same file.

• Stripe ↗ Payments

  Stripe takes the payment when you buy a license. Your card details go to Stripe; this site and I never see them.

• Cloudflare ↗ This site, the license service, the contact form

  The pages you are reading, the download link, license activation and the contact form all run on Cloudflare. No third-party analytics or advertising scripts run on this site.

• Resend ↗ Email

  When you buy a license, or write to me through the contact form, the email goes out through Resend. It carries your address and the license key, or your message. Nothing about your portfolio is in it.

• GitHub ↗ Downloads

  Every release is published on GitHub with its size and SHA-256. The download button sends you there.

• Azure Artifact Signing ↗ Code signing

  The signature on the installer and the program is issued through Azure Artifact Signing, after identity validation.

• CoinGecko ↗ Prices

  The program's first source for daily coin prices, fetched only when you ask it to fill gaps.

• DefiLlama ↗ Prices, older dates

  Where CoinGecko's free history ends, DefiLlama supplies the older daily prices.

• Binance ↗ Prices, fallback

  A fallback for coins the other sources do not carry. Not used for US users.

• Bank of Canada · FRED ↗ Exchange rates

  The Bank of Canada and the US Federal Reserve's FRED supply the daily exchange rates used to convert prices into your reporting currency.

Reporting a security problem

Write to [email protected]. The site publishes the same address at /.well-known/security.txt. For anything that is not sensitive, the issue tracker ↗ on GitHub works too. I read both myself.

Why it is built this way →   Who builds it →