Security
Last updated: 14 October 2026
Kinfolio processes several people's financial data. This page summarizes how we protect it. Please report vulnerabilities to juliuswiedemann01@gmail.com.
Read-only access
Kinfolio uses the official Parqet Connect API (OAuth with PKCE) and requests only the portfolio:read permission. We can't change anything in your portfolio.
Encrypted credentials
Parqet tokens are stored encrypted with AES-256-GCM, never written to logs, never sent to the browser and never used in URLs. Keys can be rotated without downtime.
Sharing enforced on the server
Sharing levels are enforced on the server before data reaches your browser: if someone shares totals only, their holdings and activities never leave the server towards the others. Every request checks sign-in and membership.
Servers in Germany, no trackers
Hosting and database run at IONOS in Germany. There are no analytics or advertising scripts; a strict Content Security Policy only allows our own scripts.
One-click deletion
When you disconnect, we delete tokens and cached data immediately. Deleting your account removes everything that belongs to you. You can download an export of your data at any time.
Passwordless sign-in
Sign-in links are valid for 15 minutes and single use; optionally you sign in with a passkey. Sign-ins and invites are rate-limited against abuse.