Confidentiality statement

Last updated: October 18, 2026

Indivia holds some of the most private information there is: what you own, what you owe, your income, your tenants and the people you own things with. This statement explains, in plain words, everything we do to keep it secure and confidential. The privacy policy gives the full detail of what we keep, why and for how long.

Our commitments

Your data is yours. We use it only to run Indivia for you.
News and offers only if you ask. We email them only if you ticked the box (never ticked for you) and confirmed from our email. Each one has a link to stop in one click, which works at once.
We never sell it, rent it or use it for advertising. There are no advertising trackers and no trackers from any other company in the app or on our pages. The only other company's code on our website is Cloudflare's anti-robot check on the sign-up form, which doesn't follow you or keep a cookie for advertising. If you say yes (Settings, Usage counts; off until you turn it on), your device sends anonymous counts once a day, such as which pages are opened, to our own server only, never linked to you. The server also counts how many people use Indivia and from which province or state, without keeping internet addresses.
We can't read your finances. Your data is locked on your own devices before it is sent: our server keeps it, but only you and the people you choose can open it.
The prices you see don't reveal what you hold. To get daily closing prices, your device sends once a day only the list of symbols it holds (such as TSX:RY), with no quantity, account or name and nothing that links it to you or your household.
We never ask for your bank or broker password. Indivia does not connect to your bank: it only has what you type in or import from a file.
Nobody at Indivia can open your finances. Our staff see only account and billing details (name, email, plan, payments), each looking up a customer needs a written reason, and every action on your household is recorded with its reason and shows in your sign-in history.
AI never sees your finances. No AI writes your rental ads: they are filled in on your device from Indivia's own templates. If you use the AI guide on the Help page, only your question goes, with the names of your properties, people and accounts removed, and never an amount, a date, a tenant or an account number. It is answered on our own server in Québec or by Anthropic in the United States, which may not train on it and deletes it within 30 days; the privacy policy says which and how.
Your data is kept in Canada, on your own devices and on our server in Québec. The few service providers outside Canada (for example, the one that sends our emails) receive only what they need; the privacy policy lists them.
We tell you the limits. No system is perfectly secure. Below is exactly what protects your data, and what you can do to help.

How your data is protected

Locked on your device before it is sent

Everything you enter is end-to-end encrypted: it is locked on your device before it is sent, and neither our server nor the people who run it can read it. That includes:

the names of the people, companies, properties and accounts you track, addresses, payees, memos and every free-text field and note;
amounts and dates;
account numbers (only the last 4 digits are shown, with a button to see the rest);
tenants' and applicants' details, birth dates, income and employers, bank contacts and insurance claim numbers;
statement file names, and the files and photos you attach.

Our server only sees what kind of record something is, its number and when it changed. It cannot read your finances.

Your data is locked with your household's data key, which only your devices and your printed recovery key have. A new device gets the key with a one-time code shown on one of your devices (it works once, for 15 minutes, and never reaches the server) or with your recovery key. Co-owners in another household see the assets you share with them through a key sealed for them alone.

Because we never have this key, we cannot recover your data for you if you lose all your devices and your recovery key. Keep your recovery key somewhere safe.

On your computer and phone

The whole Indivia database on each device is encrypted (SQLCipher, 256-bit AES). Its key is kept in the device's own key store (Windows Credential Manager, the Mac and iPhone Keychain, Android Keystore, or the Linux key ring), never in the file itself.
With a PIN, or your face or fingerprint on a phone, the database stays closed until you unlock it, and locking the app closes it again. The app locks when it opens and after 15 minutes without use.
After 3 wrong PINs we email you. After 5, the device erases its key and is signed out, so a stolen device gives nothing away. When you sign in again, your data comes back from the server or from your backup.
The app's screens cannot reach the database file directly: they cannot copy it, open another file with it or turn off its protections.
A Hide button blurs amounts, names and addresses when someone is looking over your shoulder, and a copied account number is taken off the clipboard after 30 seconds. The household's owner chooses which of these to use in the Security settings.
On a phone, the app switcher shows a cover instead of your figures, Android can block screenshots of the app, and a link or code you copy is taken off the clipboard after a minute.
In a web browser, you choose: on your own computer, the copy kept in the browser is locked with a PIN or a passkey; on a public computer, nothing is kept once the tab closes.

Backups, exports and sharing

Backups go to a folder you choose and are locked with the same key. Our server never has the key that opens them.
Before an Excel or PDF file is saved without protection, the app warns you and offers a password to lock it. "Export all my data" is always locked.
A package for your accountant or lender, and the legacy handoff copy, are locked on your device with a code the server never has (at least 12 letters and digits). A link for your accountant or lender ends on the date you choose and can be opened only a limited number of times a day.

Signing in

Passwords are never stored: the server keeps only a one-way fingerprint (scrypt). A new password is checked against the passwords known from data breaches, by sending out only the first 5 characters of its fingerprint, never the password.
Two-step sign-in is required with a password: a code from an authenticator app, with recovery codes for a lost phone (also kept only as fingerprints). You can also sign in with a passkey, or with Google.
Guessing is slowed down: repeated wrong passwords are delayed, and 10 wrong codes in an hour lock the codes for an hour. After 3 wrong codes, we email you: someone may have your password.
Setting up a new authenticator, making new recovery codes or deleting your account asks you to prove it's you again first.
A device that isn't used for 90 days is signed out. Your profile lists your devices, with Sign out for a lost one and Sign out everywhere else.
We email you when all your data is downloaded to a new device, when your recovery key is used and when a full export is made.
Your sign-in history (sign-ins, failures, new devices, changes, exports, shared links opened, staff access) is kept 12 months. Internet addresses are kept shortened to their network, never in full.

Inside your household

Each person you invite is an owner, an editor or a viewer, and sees only what that role allows.
An item you mark as private stays visible to you alone. A co-owner you share an asset with sees that asset and nothing else.
On our server, the database walls each household off from every other one (row-level security), so one household's request can never reach another's data.

On our server

The server is in OVHcloud's data centre in Beauharnois, Québec, on an encrypted disk.
The app and the server talk only over encrypted connections.
The few details the server must read to send you emails, such as your email address and name, are sealed with the server's own key, so a stolen copy of the database shows neither.
Our reminder and security emails say as little as possible: what kind of thing and the date (for example "A lease ends on 1 November"), never a name, an address or an amount.
The server program runs with its own minimal rights, and the machine can only be reached with a security key, never a password.
Server backups are encrypted with a key kept away from the server, and we test restoring them every month.
The server's logs never hold the secret part of a link or a full email address.
We delete what is no longer needed: reference requests 90 days after they are done, invitations after 30 days, sent reminders after 60 days, logs after 30 days, server backups after 14 days, sign-in history after 12 months.
We are alerted when many sign-ins fail at once or when unusual amounts of data leave the server.
Each staff member has their own sign-in for the staff tools, separate from the app, with two-step sign-in required (a passkey or an authenticator code), rights limited to the areas their work needs, and a lock after a few minutes without use. Looking up a customer needs a written reason, kept in our staff log; every action on a household goes in that household's sign-in history with its reason.

The app you install

The Windows installer is signed in the name of Emedianet inc., so you can check it really comes from us.
Updates are checked against our digital signature before the app installs them.
Before each release, every package the app and the server use is checked against the published lists of known security flaws.

The law

We follow Québec's Law 25: a person is in charge of protecting personal information, each service provider outside Québec had a written privacy impact assessment, and we keep an incident register and a breach response plan.
If a security incident involving your personal information could cause you serious harm, we will tell you and the privacy authorities as quickly as possible.

Your rights and your control

Export all your data from Settings, and delete your account from Your profile.
When a plan ends or goes down, what only that plan used is hidden, not deleted, for 365 days, with warnings before. Your attached files stay yours: Save my files gives them to you in one ZIP, and Export all my data still includes everything.
See your sign-in history and your devices at any time.
Found a flaw? The security page explains how to report it privately.

What you can do

Use a strong password that you don't use anywhere else, or a passkey.
Print your recovery key and keep it somewhere safe: without it and without your devices, nobody can open your data, not even us.
Set a PIN on every device.
Never send a password, a code or a full account number by email. We will never ask for them.

Questions about this statement: see the support page.