ioConta.com

Security and privacy, with clear limits

The private beta uses verified email, passwords and TOTP. You may remember a browser for 30 days after successful TOTP verification; this does not remove your password or make sessions indefinite. Keep recovery codes separately.

Authorisation is checked on the server and in the database according to context and entity permissions. Global service administrators have no ordinary financial access to wealth spaces. Demo sessions and fictional data are separate.

Financial records use server-side AES-256-GCM and per-entity keys under a master key outside the application image. HTTPS protects traffic. The authorised server can decrypt: infrastructure access is a separate concern and zero knowledge is not claimed.

Permissions, persistence and backup recovery were tested before the initial imports. This is not an external audit, a guarantee of no errors or a complete off-site backup and retention policy. Ongoing maintenance and validation are needed.

Do not enter private data in the demo or send passwords, codes or financial documents through public contact. Report security issues to info@sav.digital without secrets.