Security and limitations

What Vault keeps on your computer, what optional sync sends, and what neither protects you from.

On your computer

Vault’s free local features work without an account. Your records are stored in a file on your computer.

Vault does not encrypt the local database, local receipt files or JSON exports. They are protected by your operating system’s file permissions and by disk encryption if you have it on. Anyone with access to your unlocked computer, or to an unencrypted disk taken from it, can read them. Turn on BitLocker (Windows) or FileVault (Mac), and lock your computer when you are away. Vault’s password setting is not a substitute for disk encryption.

Receipt images attached in Vault may be resized and converted to JPEG. Keep the source files separately if you need the originals.

If you use cloud sync

Cloud sync encrypts record contents before upload. Synced amounts, descriptions, categories, notes and account details are encrypted on your device, and so are synced receipt images.

Some information stays readable to us because the service needs it: your email address, subscription status, record identifiers and timestamps, and storage usage. Synced receipt metadata identifies which transaction has an image attached.

What the app connects to

Update checks ask pfmvault.com whether a newer version exists. They send no account or financial information.
Investment prices, if you refresh them, request a price for each ticker you hold from a public market-data service.
A direct Up Bank connection, if you set one up with your own token, talks to Up from your computer.
Account services, if you create an account: sign-in, sync and payments.

The Privacy Policy lists each service, what it receives and where it is.

Independent review

We have not published an independent security review. Source checks and automated tests are part of development; they are not independent assurance.

We have not published an independent review of Vault’s tax calculations.

Installing and verifying a download

	Windows 11 · x64	Mac · Apple silicon
Version	Vault 0.8.4, released 15 October 2026	Vault 0.8.4, released 15 October 2026
File	vault-windows-x64-setup.exe	vault-macos-aarch64.dmg
Size	6,629,337 bytes	8,782,620 bytes
SHA-256	7025fa77931d7b88be1ba01ffc1817939aaf1f9317605ecd376198af4e16100e	8d83a3c70563fc7d7beb546d35b589ebdd329128962ff04a89359433bf643a2d
Signing	This installer is unsigned. Windows may show “Unknown publisher”.	Ad-hoc signed. This does not verify the publisher’s identity. Not notarised by Apple.

Check the file you downloaded

Compare the output with the SHA-256 above. If they differ, do not run the file.

On Windows, in PowerShell, from the folder you downloaded to:

Get-FileHash .\vault-windows-x64-setup.exe -Algorithm SHA256

On a Mac, in Terminal, from the folder you downloaded to:

shasum -a 256 vault-macos-aarch64.dmg

Opening it the first time

Because the installers are not signed with a verified publisher identity, your computer will warn you. Check the SHA-256 first.

Windows: if SmartScreen shows “Windows protected your PC”, choose More info, check the file name, then Run anyway.
Mac: if macOS says it cannot verify Vault, open System Settings, then Privacy & Security, and choose Open Anyway for Vault.

The Mac download is for Apple silicon. Do not use it on an Intel Mac.

Where downloads come from

Downloads normally pass through pfmvault.com. If that service cannot retrieve an installer, your browser may be redirected to our official GitHub release repository, Adhjk21/vault-releases. GitHub then receives the normal information sent with a web request, including your IP address.

Official GitHub releases Download Vault

Reporting a problem

If you find a security problem, email [email protected]. Please do not include your own financial records.