Security isn’t one lock — it’s a series of doors, each with its own key. We designed Avelia so that your data is protected at every stage: on your phone, while travelling through the internet, and while resting on our servers.
Your data is encrypted at rest using keys stored in your phone’s secure hardware (Keychain on iOS, Keystore on Android). Even if someone has physical access to your phone, they cannot extract your Avelia data without your biometric or passcode.
All communication uses TLS 1.3 — the same encryption banks use. On top of that, your data is already end-to-end encrypted before it ever reaches the network. Even if someone intercepts the connection, they get double-encrypted noise.
We store only ciphertext — encrypted data that we cannot decrypt. Our servers run in German data centres under EU jurisdiction. Even our own employees and developers cannot read your entries.
No device is perfectly secure. That’s why we build defences that assume the worst:
Encryption keys are stored in tamper-resistant hardware, separate from the main processor. Even sophisticated attacks that compromise the operating system cannot extract them directly.
Sensitive data is cleared from memory as soon as it’s no longer needed. We never write decrypted data to disk or swap files.
Avelia detects modified operating systems and warns you. On compromised devices, additional protections activate to limit exposure.
After a period of inactivity, the app locks and requires re-authentication. Decrypted data is purged from memory.