Security is shared
Security is a shared responsibility. Monario protects the service and vault design, while users must protect their account, device, encrypted backups, and vault password.
Monario local encrypted vault
Monario keeps financial data in a private encrypted vault on the user’s computer. A free account may be used for activation and access management, but local vault financial data is not synced unless the user enables Monario Plus sync. The desktop runtime owns local vault creation, unlock, save, backup, and export.
Monario Plus protected sync and optional E2EE
Monario Plus synchronizes a user’s workspace across web and desktop. Standard workspaces use HTTPS, strict per-user database access controls, and provider-managed encryption at rest. Users may instead create a private end-to-end encrypted workspace; in that mode financial records are encrypted before upload and decrypted only on their devices.
Workspace data stored by protection mode
A standard Monario Plus workspace stores financial records in the app database so the service can provide seamless web access and synchronization. A private E2EE workspace stores ciphertext instead. Account, authentication, subscription, device, revision, and security metadata remain server-readable in both modes.
What Monario can and cannot see
| Data type | Stored where | Can Monario read it? |
|---|---|---|
| Account email/auth metadata | Auth provider/app database | Yes |
| Mandatory auth/security logs | Auth provider/app database | Yes, minimized security metadata only, no financial vault data |
| Subscription/billing metadata, if paid plans are enabled | Payment provider/app database | Yes, limited metadata |
| Support messages and attachments | Support/email systems | Yes, if user sends them |
| Monario local vault financial data | User computer/device | No |
| Exported .mvault backups | User-controlled file storage | No, unless user shares the file/password |
| Monario Plus standard workspace | Sync storage/app database | Yes, as needed to operate the service; protected by access controls and encryption at rest |
| Monario Plus private E2EE workspace | Sync storage/app database | No; financial records are encrypted on the device before upload |
| Analytics events, if enabled | Analytics provider/app database | Yes, minimized product events only, no clear financial data |
Password responsibility
The Desktop vault password protects the local vault. A private E2EE workspace uses a separate encryption password and recovery key. Resetting the account password does not recover either secret; private workspace contents may be unrecoverable if both are lost.
Export and backups
Monario users should export encrypted .mvault backups manually. Monario Plus adds synchronized cloud continuity. Private E2EE workspaces encrypt financial records before upload; standard workspaces rely on managed service protections. Users should verify recovery and restore flows before relying on either mode.
Secure transport
Monario uses HTTPS/TLS for transport between browsers and service infrastructure. Secure transport protects data in transit but does not replace vault encryption or device security.
Database access controls for user-owned records
Database-level access controls isolate user-owned workspaces, sync metadata, standard records, and encrypted records. Record writes pass through an atomic, version-checked mutation function rather than direct client table writes.
Auth and security audit logs
Monario keeps mandatory auth/security audit logs separately from optional product analytics. These records support account integrity, abuse prevention, and security investigation.
Auth/security audit logs are minimized and should not include financial vault data, account names, transaction descriptions, CSV content, notes, raw user agents, or browser-supplied IP addresses.
No service-role keys in browser
Service-role keys and other privileged server secrets must not be exposed in browser-delivered code. Browser code should use public client configuration only, with server-side privileges reserved for trusted server contexts.
Incident response process
Monario maintains an incident response process for confidentiality, privacy, and security incidents. The process includes triage, containment, impact review, remediation, documentation, and user or regulator notice when required by applicable law.
Architecture summary
Monario vault: user computer -> encrypted local vault -> optional encrypted .mvault backup. Local vault financial data does not require server sync.
Monario Plus standard sync: device -> HTTPS -> access-controlled workspace with managed encryption at rest -> another authorized device.
Monario Plus private E2EE sync: device encrypts financial record -> ciphertext sync storage -> another authorized device decrypts locally.
Important limits
- No system removes every risk.
- Encryption reduces risk but does not remove every risk.
- Users must protect account credentials, devices, exported .mvault backups, and vault passwords.
- Users should review imported CSV data and exports before relying on reports.