How Scotis protects your data.
What happens on your device, what travels over the internet, and where the limits are. Without jargon where possible, with the technical details for those who want them.
On your device
- Everything you enter or import is encrypted in your browser with AES-256-GCM and kept in your browser’s storage (IndexedDB), on that device only.
- The key is derived from your password using PBKDF2-SHA256 with 600,000 iterations (the OWASP recommendation) and a random salt. Every save gets a new random IV.
- The key is only held in memory while the app is open. After the time you have set, the app locks itself.
- Import files (bank, broker, pension) are read on your device and are not uploaded.
Recovery code
- When you start, the app creates a 24-character recovery code on your device (about 120 bits of randomness).
- That code is used to create a second encrypted copy of your data (PBKDF2, 210,000 iterations). The key to that copy is itself encrypted with your password, so the copy is updated with every change.
- If you forget your password, you use the code to choose a new one. The code never reaches us. If you create a new code, the old one stops working.
Brake on guessing
After 3 incorrect attempts (password or recovery code) you have to wait 30 seconds. With each further mistake the waiting time doubles, up to a maximum of one hour. Reloading does not help either. There is deliberately no permanent lockout: we cannot reset anything, so you would lock yourself out for good.
Sync and partner
- Sync is end-to-end encrypted with a random AES-256 key that is stored only on your devices. That key travels in the pairing link or QR code, never to our server.
- Our server only stores the encrypted data, a version number and the last 7 daily encrypted copies. We cannot read them.
- Your partner views it on their own device, with their own password and recovery code.
What does travel over the internet
| To | What | Why |
|---|---|---|
| SEC (US companies only) | Which company you are viewing | Official annual and quarterly reports |
| Scotis server | Encrypted sync data, licence, email address with Pro | Sync and subscription |
| Scotis server (and from there, our market data supplier) | The name, ISIN or coin symbol of investments you request prices or figures for. Never quantities or amounts | Prices, exchange rates, logos and company figures without your own key |
| Scotis server (Pro, if you turn on alerts) | Your browser’s push address, the ISIN or coin, your threshold and the name of the position | Alerts, even when the app is closed |
| Resend (on behalf of Scotis) | Your email address | Login codes and your Pro code |
| Paddle | Payment details, directly with Paddle | Payment; we do not see your payment details |
No tracking cookies, no advertising networks, no analytics tools that follow you.
Reporting a security issue
Found a vulnerability? Send an email to [email protected] with "security" in the subject line. We aim to respond within 3 working days.