How PopaDex Encryption Works
How your private vault, necessary service information and recovery keys are protected.
PopaDex implements E2EE for all PII that can be end-to-end encrypted in your private financial vault. E2EE is enabled by default for new accounts; necessary service information has separate protection.
Encryption under your control
Your device encrypts protected vault information before it is saved. The stored values are ciphertext, and your vault’s encryption keys control access to them.
Protected information includes account names, balances, financial-history amounts, private interest settings and retained private bank details. Login credentials and financial unlock material are separated in the E2EE protocol.
Required service access
Email delivery, authentication, billing and connected-bank services need some information to perform their functions. This information uses server-managed protection and appropriate access controls. Routing, ownership and scheduling metadata supports the operation of the service.
During supported automatic bank sync, readable bank responses are processed temporarily. Retained private values are encrypted immediately for the E2EE vault. Connection credentials remain protected with service-managed encryption so bank synchronization can operate.
Recovery and devices
Your encryption recovery key is generated and shown on your device. The service receives encrypted key material; the recovery secret remains under your control.
Password changes preserve the encryption key protecting existing financial data. A login reset alone cannot unlock that data. Recovery requires working encryption or recovery material.
Device protection supports convenient unlock without retaining a readable password. Protect access to your device and keep your recovery key secure.
Scope
New accounts receive E2EE by default. Some older accounts predate automatic encryption setup and need E2EE enabled. This protection covers your private financial vault. Public tools, information deliberately shared with others, and required service processing have separate workflows.
See end-to-end encryption and your personal data for the customer overview.