We can't see your financial data and we don't need to

Yes. Your portfolio is encrypted on your device with AES-GCM using a key derived from your password via PBKDF2 — the resulting key material is non-exportable WebCrypto, so it can't be read back even by Capitally's own application code. Our servers only ever see ciphertext. If the database were breached tomorrow, the extracted blobs would be mathematically unreadable.

Multi-device sync stays zero-knowledge through RSA-OAEP key wrapping: encrypted keys move between your devices, plaintext keys don't. Three encryption modes — User Password (default), Project Password (a separate password per project), or Remote Key (server-derived, lowest-friction) — let you pick the trade-off between key isolation and convenience.

Most other trackers describe themselves as "bank-level encrypted" or "military-grade". Both describe the same AES every web service has used for a decade, and neither says anything about who holds the keys. End-to-end encryption means only you hold them. For the full spec see data safety.

No. Your portfolio is end-to-end encrypted on your device with a key derived from your password — Capitally's own engineers, contractors, and infrastructure team cannot decrypt it. The servers store ciphertext only; the encryption keys never leave your devices and the key material itself is non-exportable, so even our application code cannot read it back out.

The same property protects you from a subpoena, a server breach, or a curious insider. There is nothing readable on our side to compel, exfiltrate, or browse — your holdings, transactions, account names, notes, and balances are all encrypted before they leave your device.

What we can see — and are transparent about — is non-portfolio metadata: operation type (transaction created, updated, deleted) and the timestamp of each change. That's necessary for sync to work, and it doesn't include amounts, instruments, or any text you write. Optional product analytics, also documented in data safety, are opt-in and never include investment values.

All Capitally servers and databases live in EU data centres — your encrypted data never leaves European jurisdiction. The infrastructure stack is Google Cloud Europe, Hetzner, MongoDB Atlas (EU regions), and Cloudflare's EU edge. There is no US CLOUD Act exposure, and GDPR and DORA apply by default rather than as an opt-in compliance layer.

What lands on those servers is ciphertext only. Your portfolio is encrypted on your device with a password-derived AES-GCM key before any sync — so "where the data is stored" describes where the encrypted blobs sit, not where your plaintext holdings sit. The plaintext only ever exists in memory on your own browser or device.

Industry-standard server hygiene sits on top of end-to-end encryption: TLS in transit, encryption at rest, need-to-know employee access, and access logs. The server hygiene is the floor; the encryption is what actually protects your data.

Yes. Capitally is built and operated under GDPR. Servers and databases sit in EU data centres, and the underlying portfolio data is end-to-end encrypted on your device with AES-GCM — Capitally itself can't read it, so the GDPR data-minimisation and purpose-limitation principles are enforced at the cryptographic layer rather than just at the policy layer.

Export and permanent deletion are one-click operations inside the app, with no email or support ticket required. Export covers all your portfolio data - decrypted on your device, then saved as CSV, Excel, or JSON. Deletion permanently removes the encrypted store along with the surrounding metadata.

We don't transfer personal data outside the EU, don't sell or rent it, and don't run third-party advertising trackers on the app. See data safety for the encryption model, or the Privacy Policy for the full legal text.

End-to-end encryption has a real trade-off: because only you hold the key, password recovery cannot rely on an email link that lets Capitally decrypt your data on your behalf. If we could do that, we could read your portfolio too — which would defeat the point.

To make this manageable, Capitally offers three encryption modes when you create a project, each with a different recovery model. User Password (default) ties decryption to your login password — the strongest privacy, but you are the only one who can recover the data. Project Password lets you set a separate, easier-to-remember password per project. Remote Key keeps the encryption key segregated on a dedicated endpoint that derives it on the fly from your credentials plus our private key — convenient recovery via the normal account-reset flow, at the cost of trusting our key segregation.

Practical advice: pick the mode that matches how you balance privacy against recovery friction, store your password in a reputable password manager, and export your portfolio periodically so a forgotten password is at worst an inconvenience, not a loss.

Your data is kept end-to-end encrypted for at least 6 months after the trial or subscription ends, so resubscribing within that window restores your full investment history with nothing to rebuild.

Permanent deletion is a one-click action inside the app — no email or support ticket required, and once it's gone, the encrypted store and surrounding metadata are removed for good.

Either way, you can export everything to CSV, Excel, or JSON before leaving, so the full historical record stays with you regardless of what happens to the account.

No. Capitally never connects to your bank or broker through Plaid, Yodlee, or any other open-banking aggregator — brokerage and banking credentials stay with you. There's no shared password, no read-only API token, no third party in the data path. See data safety for the full encryption and hosting model.

Imports go through CSV, Excel, paste from a spreadsheet, or manual entry. Most major brokers — Interactive Brokers, Degiro, TastyTrade, Schwab, Coinbase, Kraken, XTB, and many others — have native CSV presets, so the first import is usually a single-file upload. For brokers without a preset, the flexible importer maps columns to Capitally's transaction model on the fly.

There's also a precision advantage. Aggregators typically expose only current balances, or transactions from the past ~3 months — they rarely surface the full account history. Broker CSV exports usually go back to the day the account was opened and include the events that move cost basis: corporate actions, dividend reinvestments (DRIP), deposits and withdrawals, FX conversions. With that detail intact, returns calculate correctly over the actual holding period, cost basis is auditable lot by lot, and the data is ready for tax filing — not just a dashboard. Manual entry preserves the same fidelity for assets that have no broker feed at all.

The tradeoff: there's no auto-sync, so importing a new month of activity is a deliberate action you take, not something that happens silently in the background. That's the right fit for advanced DIY and HNW investors who want privacy and the data depth a third-party feed can't deliver — not the right fit for someone who explicitly wants a one-click aggregator dashboard.

Your financial data is end-to-end encrypted on your device with AES-GCM, using a key derived from your password — Capitally itself cannot decrypt it. We never connect to your broker or bank either: no Plaid, no Yodlee, no open-banking aggregator, no shared credentials. If our database were ever breached, the extracted data would be unreadable.

The CSV-only import path is also more accurate than aggregator sync. Broker exports usually go back to the day the account was opened and carry the corporate actions, dividend reinvestments and FX conversions that aggregators tend to drop — so cost basis stays auditable and returns reflect the real holding period.

We don't sell financial data, behavioural patterns, or any other personal information. Product analytics are limited to feature adoption and performance, are opt-out, and never include the size or value of your investments.

All servers and databases live in EU data centres, with TLS in transit, encryption at rest, and standard security practices on top of the per-user encryption. Export and permanent deletion are one-click operations inside the app — no email required.

For the full encryption model — including PBKDF2 key derivation, RSA-OAEP key wrapping, and how multi-device sync stays zero-knowledge — see the data safety guide.

Capitally is built around three deliberate safety choices that put a hard floor under what can go wrong. Your portfolio is end-to-end encrypted on your device with AES-GCM and a password-derived key — so a server breach yields ciphertext, not holdings. Capitally never connects to your bank or broker through Plaid, Yodlee, or any other open-banking aggregator — your brokerage credentials stay with your broker, and the credential-sharing risk class is removed by design. And every server lives in the EU under GDPR and DORA — your data does not leave European jurisdiction.

What Capitally cannot protect against, and is transparent about: a supply-chain or man-in-the-middle attack that replaces our source code (mitigated by browser CSP and HTTPS, but no provider can claim full immunity), and unauthorised access on your own device if you don't protect your browser profile or your password manager.

For full detail — encryption spec, what we collect, what we don't, retention, and export — see the data safety guide. The Privacy Policy covers the legal side.

No. Server-side AI summarisation, recommendation, or "insight" features require servers that can read your portfolio in plaintext. Ours can't — the data is end-to-end encrypted on your device — so we don't ship those features, by architecture rather than by policy.

The trackers that do offer AI portfolio assistants typically store your holdings unencrypted on their servers, then pass them to a cloud language model that also retains some right to log, train on, or process the data. Even when the language-model contract forbids training, there is now an additional party who, given a breach or a lawful demand, can see your full portfolio.

Capitally takes the other side of that trade-off: cost basis, IRR, TWR, dividend forecasts, options Greeks, and tax calculations all run locally on your device against your decrypted data. No cloud model ever sees your holdings. This is also why Capitally does not surface a chatbot for your portfolio — and we think the absence is worth more than the convenience would be.