We built Mali so your documents are encrypted on your device before they ever reach our servers. Here's exactly how it works.
You pick a bank statement, tax return, or any financial document from your device. Nothing has left your device yet.
Your browser reads and extracts the text from the document entirely locally. The raw file never touches our servers.
On your device onlyThe extracted text is encrypted using AES-256-GCM — the same standard used by banks and governments. The encryption key is derived from your Google account ID using PBKDF2 with 600,000 iterations. We never see the key.
AES-256-GCM · PBKDF2 · 600k iterationsWe store a binary blob in our database that looks like random noise. An external attacker who breached our database would find only ciphertext — unreadable without your account key.
Ciphertext only · Unreadable without your keyYour device fetches the encrypted blob, decrypts it locally, and sends the content to our AI provider (xAI Grok) to answer your question. The decrypted data exists in memory only for the duration of your session — it's never stored on our servers.
Decrypted on your device · Not stored by usSign in on your phone and your encrypted vault syncs automatically. The same key derived from your Google account decrypts it on any device you own.
Security by design
Every layer of the stack is built with your privacy in mind.
Hosted on Firebase / Google Cloud — SOC 2 Type II, ISO 27001, and PCI DSS certified. Google handles physical security, network security, and infrastructure patching.
Your encryption key never leaves your device. It's derived from your authenticated Google account using AES-256-GCM and PBKDF2. We have no master key and no backdoor — but our staff with Firebase admin access could derive a user's key from their account ID, so this is not a fully zero-knowledge system. We're transparent about that tradeoff.
Firestore security rules enforce strict isolation. No user can access another user's data — not even accidentally. Every read and write is verified against your authenticated identity.
All traffic between your device and our servers is encrypted in transit using TLS 1.2 or higher. Enforced by Google Cloud — no configuration required on our end.
Delete any document or your entire account at any time from Settings. Deletion is immediate and permanent — including the encrypted blobs and the salt used to derive your key.
Every data access event is logged. If you ever want a record of what happened with your data, it's there. Logs are retained for 12 months then automatically deleted.
Common questions
Straight answers, no marketing speak.
No. Your documents are encrypted on your device before they reach our servers. We store ciphertext — binary data that's meaningless without your encryption key, which only you hold.
When you ask a question, your device decrypts your documents and sends the relevant content to our AI provider (xAI Grok) to generate a response. It's processed per-request and your financial data is not stored by the provider. See xAI's privacy policy.
An external attacker would find only encrypted blobs and PBKDF2 salts. Without your Google account credentials to derive the decryption key, the data is computationally infeasible to decrypt — AES-256-GCM has never been broken. Note: a sophisticated attacker who also compromised our Firebase admin credentials could derive user keys from account IDs (this is the limitation of UID-derived keys; a real zero-knowledge system would require a user passphrase). We're working on a passphrase-based opt-in for users who want true zero-knowledge.
Your encrypted data would be inaccessible — this is the tradeoff of account-key-based encryption. We recommend ensuring your Google account has recovery options configured.
No. We don't sell your data — see our Privacy Policy. Your financial data is encrypted before it reaches our database.
Open the app → Settings → "Delete all my data." This permanently removes all your documents, conversation history, and encrypted blobs from our servers. It takes effect immediately.
Your financial data stays yours. Always.
Open Mali →