Security and encryption.
We state our security implementation plainly and accurately, without exaggerated marketing buzzwords or unfounded claims for data that is backed up to your account.
Implemented security controls
Phone-level AES-256 vault encryption
Vault items are encrypted with AES-256 (CBC with HMAC-SHA256) on your phone before backup.
PIN-derived local key
The Vault key is derived from your PIN on the phone and never leaves it.
Biometric and PIN unlock
PIN and optional fingerprint or face unlock protect access to your sensitive records.
Encrypted transit over TLS
Connections to our servers and AI provider use TLS encryption.
Optional app lock
Optional app lock with fingerprint secures the entire application upon exit.
What is encrypted where
A precise breakdown of how different types of data are encrypted, stored, and accessed.
| Data Type | Storage Location | Encryption Method | Who Can Access |
|---|---|---|---|
| Vault items (passwords, cards, IDs, secure notes) | Encrypted on your phone, then backed up to your account | AES-256 (CBC with HMAC-SHA256) on phone. Key never leaves your phone. | Readable only by you. Xciah cannot read Vault items. |
| Other entries (spending, income, habits, tasks, mood, notes) | Stored in your Google Firebase account (India region) | Encrypted in transit (TLS) and encrypted at rest by Google Cloud. | Readable by you. The Xciah team can access non-Vault data only for support, security, and fixing problems. |
| AI requests (chat text, data summary, voice, scanned receipts) | Sent to AI provider in the cloud through Xciah servers | Encrypted in transit using TLS. | Processed only to produce your answer. Never used to train AI models and never sold. |
Report a security issue
Responsible disclosure and vulnerability reporting
If you believe you have discovered a vulnerability or security issue within Xciah or our backend services, please report it immediately to our security response team at [email protected].
Please include steps to reproduce the issue. We review all valid security disclosures promptly and work directly with researchers to remediate issues before public disclosure.
Xciah is in closed beta for Android and iOS. Join the waitlist to get an invite.
Try everything free for 7 days. No card needed.
Join the beta