Protect your encryption recovery secret

Updated 23 Oct 2026 · Important security guide

Guarded lost-secret reset: A reset workflow exists in current application source but is destructive and must not be used to guess or bypass a lost secret. Protect and verify a complete local backup before proceeding, and check the actual deployed reset controls. With no original secret or usable copy, the old encrypted cloud records cannot be recovered. Safe sign-in and restore checklist →

Keep your recovery secret and an independent backup. Cashflow Pilot cannot retrieve your secret or decrypt financial cloud data without it. Losing it without another usable copy can mean permanent loss of your records.

What is encrypted?

When you enable Cloud Sync, Personal, Portfolio and Business financial records are encrypted on your device using AES-256-GCM before upload. Cloud storage contains ciphertext rather than readable financial content. The server cannot decrypt these records. Account email, sign-in, session, device, administration and optional provider metadata are processed separately to operate the service.

1. Save your 43-character secret

Store the entire secret in a trusted password manager or another protected location you can access if your phone or computer is lost.
Check that every character is correct. Do not rely on just one browser to remember it.
An email sign-in code identifies your account but cannot replace the encryption secret.

2. Unlock on a new browser or device

Sign in with your normal account method.
Enter your existing recovery secret when you unlock encrypted Cloud Sync.
Allow sync to complete, then check Personal accounts, Portfolio holdings and history, and Business books and balances.

3. If you lose the secret

Do not clear, reinstall, reset, sign out of or delete the last device that can still open your data.
On an unlocked device, make a complete backup and verify it includes your financial records.
If you have an earlier backup, confirm that you can restore and use it before taking destructive action.
Only once another complete usable copy is secure should you follow a supported cloud deletion/reset procedure, choose a new recovery secret and resync. The exact controls depend on the deployed version; contact support before a destructive step if unsure.

If neither the original secret nor another usable local copy or backup exists, the encrypted cloud records are unrecoverable. Cashflow Pilot cannot bypass end-to-end encryption.

4. Cloud Sync is not a backup

Maintain a separate full backup, especially before moving devices or making large imports. Exported backups may contain readable financial and payroll data and are not automatically encrypted by your Cloud Sync secret. Store them in appropriately encrypted storage. Original documents may have separate backup handling.

Want to see exactly how a transaction looks to the cloud database? View a fictional AES-256-GCM example.

← Back to Help Centre