Your books are encrypted so that we can't read them.

Neo-Capital comes in two versions, and they do not have the same level of privacy. Here is the difference.

If you want your keys to stay off our servers at all times, use Desktop, with Connected sync between your computers if you need it, and do not open your books in a web browser or the mobile app.

We need to confirm it's you without learning your password. Neo-Capital does this the same way password managers do. Before anything leaves your device, your password is turned into two separate keys.

1. Step 1: on your device

   Your password goes through scrypt, a deliberately slow, memory-hard function, together with a random salt. It is slow on purpose, because that makes guessing passwords very expensive for anyone who gets a copy of the stored data.

2. Step 2: the split

   That result is split by HKDF into two keys that cannot be derived from one another. One unlocks your books. The other is what we receive as your "password" when you sign in.

3. Step 3: what we receive

   We always receive the sign-in key. It is created one way, so it tells us nothing about the key that unlocks your books. On Online, your browser also sends the key that unlocks your books to our server for the length of your session, and it is never stored there. With Desktop, that key stays on your computer. Your actual password is never sent, logged or stored in any form.

Your books themselves are locked with a separate data key, sealed to your account's public key. Because of this extra layer, you can change your password without re-encrypting every record. It also lets you share your books with a bookkeeper by sealing the same data key to their key, so nobody has to share a password.

Your password protects your data well, but passwords can be reused, stolen or entered on a fake site. Two more controls protect your account.

Two-factor sign-in

When you turn it on, signing in also requires a six-digit code from your authenticator app. It uses standard TOTP, so it works with Google Authenticator, 1Password, Aegis or any app you already use.

What a correct password gets you

With two-factor on, a correct password alone gives no access until the code is entered. That includes your encrypted private key. An attacker could take that key and your salt and try to guess your password offline, so we don't send either one until the code is confirmed.

Backup codes

You get ten backup codes when you turn on two-factor, and they are shown only once. Each code works one time in place of a code from your app, so you can still sign in if you lose your phone. They replace the code only and never the password, so someone who finds them still cannot sign in.

Re-entering your password

Changing the things that protect your account (turning two-factor on or off, re-issuing backup codes, deleting the account) asks for your master password again, even though you are already signed in. Someone could use your session on a shared computer or an unlocked laptop. Asking for your password again stops them from locking you out of your own account.

Turning it off

To turn off two-factor, you need your password and a current code. Someone using a stolen session would try this first, so it requires both.

The secret that creates your codes is held by our sign-in provider. It is not stored in our database or in your books.

This is what we store for Online and for Connected sync. Everything else, including every transaction, invoice, balance and note, is inside the encrypted data.

Your books

Encrypted with AES-256-GCM, with a new random nonce each time. If the encrypted data is altered, it fails to open, so it cannot be changed without the change being detected.

Your public key

This key is meant to be public. Others use it when they share their books with you.

Your private key

We store it, but it is locked with the key that comes from your password, and we do not store that key.

A sign-in secret

This is the sign-in key from step 3. It lets us confirm it's you, but it cannot decrypt anything.

A salt, and its version

These are inputs to the slow function in step 1 and are not secret. The version records which parameters your account was created under, so we can strengthen them over time without locking anyone out.

Your email and billing

This is normal account information, and it is the only item on this list that our staff can read.

If our servers were breached, the attacker would get this list. Your stored books would be encrypted, and the key would not be stored with them. An Online session that is open during a breach is the exception described in "Known limits" below.

This section is for security reviewers. We use only standard, well-reviewed cryptography. We don't use any custom or homemade encryption.

Symmetric encryption

AES-256-GCM with a fresh 96-bit random nonce per operation. Authenticated encryption throughout: there is no encrypt-without-authenticate path anywhere in the codebase.

Key agreement

X25519, with an ephemeral keypair generated per wrap, so compromising one sealed key does not unravel the others.

Key derivation

scrypt for passwords; HKDF-SHA256 with domain separation for everything derived from a master secret, so two keys derived for two purposes are independent.

Sync integrity

Each synced record is cryptographically bound to its position in the sequence, so a server cannot reorder, replay, or drop records without the client noticing.

Randomness

Cryptographic sources only: for keys, nonces, salts, recovery codes and tokens. We never use a general-purpose random number generator for security.

Comparisons

Constant-time on every authentication path, so timing cannot be used to guess a secret one byte at a time.

In transit

HTTPS everywhere, certificate-validated, with outbound connections restricted to known hosts and blocked from reaching internal addresses.

Many people are cautious about connecting a bank, and that's reasonable. Here is how the connection is kept safe. Plaid bank feeds are included on Online and with Connected.

If you use Get Paid to let customers pay an invoice by card, the card fields on that page belong to Stripe. Stripe's own code displays them, and they are sent directly to Stripe. Card numbers do not pass through our servers, appear in our logs, or exist anywhere in our code. The money moves directly between your customer and your own Stripe account. We never handle it.

Every message Stripe sends us is cryptographically signed and verified against the exact bytes received before anything is recorded, and each payment is recorded only once, so a duplicate or repeated notification cannot mark an invoice as paid twice. Nobody can cause a payment to appear in your books without an actual signed message from Stripe.

Every posting, edit, reversal and void is written to a history that the application cannot rewrite: the database itself refuses updates and deletions on it. Each entry is cryptographically linked to the one before it, so removing or altering a row breaks the chain. The whole chain is checked again every time you open the audit page, and any break is clearly reported. The audit trail page is part of Pro and Firm.

Sign-ins, connection changes and exports are recorded in the same history as your journal entries, so you can see when a copy of your books was exported.

Giving an AI assistant the ability to change a ledger carries real risk, so we built strict limits into it.

Nothing changes without a click

Every change the assistant wants to make becomes a card you read first, showing exactly which rows it touches. It runs when you press Apply, and every applied change is reversible and lands in the audit trail above.

It cannot send data out

None of the assistant's tools can open a web page, send an email or write a file. Even if someone tricked the model into trying to leak your data, it would have no way to send it.

Outside text is treated as data

Text that arrives from outside your business (a vendor's invoice memo, a bank description, an uploaded document) is explicitly fenced before the model reads it, and the model is instructed to treat anything inside as evidence rather than instructions.

A read-only switch

One setting stops the assistant changing anything at all, checked both when a change is proposed and again at the moment you apply it.

Your key or ours

If you use your own API key, your data goes to the provider you chose, and they bill you. If you use Neo-Capital AI (a paid add-on from $19 a month), it runs on our account. In both cases, your data is not used to train AI models.

Some of our protections come from features we chose not to build.

• No tracking. The desktop program does not send usage data. It contains no tracking code, and it sends an error report only when you click the button to send one.
• We don't sell data. Your books are stored encrypted and we never look at them. We don't sell your data, use it for benchmarks, or share it with lenders.
• No account needed to use Desktop. You create a free account to download the program. After that, you can use Desktop without signing in, and your books never have to be sent to us.
• No hidden admin access. We have no support tool that can open a customer's books.

When you sign up, we show you a recovery code one time. Your keys come from your password, and we never receive your password, so a "reset my password" email link cannot work. A company that can reset your encryption password has access to your keys.

The recovery code recovers the same underlying keys under a new password, so shared books and connected devices keep working afterwards. Write it down and keep it somewhere safe. If you lose both your password and your recovery code, nobody can recover your books, including us.

Can you read my books?

On Desktop, no, because we never receive your books. For sync between Desktop computers, no, because we store only encrypted data and never have the key. On Online, and when you open Connected books in a browser or the mobile app, we cannot read the stored copy. While you are signed in, your books are decrypted in a temporary workspace for your session, and no one at Neo-Capital opens them.

If you get hacked, is my financial data exposed?

Stored books would stay encrypted, and the attacker would not have the key. An Online session that was open during an attack is the exception described in "Known limits" above.

Can one of your employees look at my data?

No. We don't store your keys, and we have no internal tool for opening a customer's books.

What happens if you receive a subpoena?

We can produce your email and billing records. Your stored books could only be handed over encrypted, which is the only form we store them in.

Do you train AI on my data?

No. When you use the assistant, the data it needs is sent to the AI provider only for that request, and under your own API key if you use one.

Do you support two-factor?

Yes. You can turn on TOTP two-factor sign-in in your account settings, and you get backup codes. With it on, a correct password alone does not give access to your account or your encrypted key.

Can the bank connection move my money?

No. It requests read access to transactions and nothing else.

What if Neo-Capital goes away?

Desktop books are a file on your computer and stay yours. Everything exports (the full data file, CSV, PDF), and the desktop app keeps working without us.