How your data is protected

Security is easier when little can be read. Here is the design, in plain words.

Where the data is

Your entries are kept encrypted in a database at Infomaniak in Switzerland, and cached on the device you are signed in on so the app opens instantly and works offline. Signing out clears that cache. Every entry is encrypted with a key that belongs to your account alone; that key is itself encrypted with a master key kept outside the part of the server the web can reach. Each encrypted record is also bound to the account and the day it belongs to, so a record read for the wrong account will not decrypt at all rather than reveal itself in the wrong place. Every request for data is answered only for the account whose sign-in cookie it carries.

Your e-mail address is stored encrypted, with a keyed hash used only to find your account when you sign in. Your password is never stored: a slow hash of it is (Argon2id), and sign-in attempts are limited so that guessing does not work. A sign-in is remembered by a random token that is stored only as a hash, in a cookie the page's scripts cannot read. A password-reset link works once, for one hour, and signs every other device out.

The Plus table on the same server holds e-mail, plan, status, renewal date and the account it belongs to, nothing else. Card data never reaches it; Stripe holds that.

Sessions you control

Under Account & subscription you can see every device signed in to your account, sign any of them out, change your password (which signs the others out), or sign out everywhere at once.

Transport

The app is served only over HTTPS with a valid certificate, and tells browsers to never use anything else (HSTS). The offline copy on your phone is a cache of those same files.

No third-party code

The app loads no analytics service, no advertising scripts and no external libraries at run time. Its typefaces are served from the same site, so not even a font request reaches another company. The only counter is the operator's own, on the same Swiss server, and it never sees an IP address or anything you typed. What you see is what runs.

Backups

Infomaniak's backups of the hosting contain the account database only in its encrypted form; deleting your account also deletes the key that could read your records, so a copy that survives in a backup is unreadable. Exports are created on demand, by you, and go only where you send them.

Releases

Every version of the app is kept in a version-controlled repository and published through an automated pipeline, so a release can be rolled back within minutes.

Reporting a problem

Found a security issue? Write to hello@bestversion.ch. Reports are answered personally.