Security & control

Your information, with controls you can understand

Holvario holds personal, financial and household information — so here's a straight account of how it's protected and what you control. No inflated claims.

Start free trial → Ask a security question

Account security

Protecting the way you sign in

Optional 2FA

Turn on authenticator-app two-factor sign-in for an extra layer on your account.

Encrypted connections

Traffic between you and Holvario travels over encrypted connections.

Account-level access

Strict account-level access controls keep your data scoped to you.

The Vault

A client-side encrypted, zero-knowledge Vault

Encrypted in your browser. Only you hold the key.

Your Vault is encrypted on your device with AES-256 (keys derived with Argon2id) before anything is saved. Your passphrase never leaves your browser, so no one, not even us, can read what's inside. That's what zero-knowledge means.

Your Vault passphrase is separate from your login. It's built for sensitive notes and records, not a full password manager (no browser autofill or credential auditing yet), and we won't claim capabilities it doesn't have. Because only you hold the key, if you lose your passphrase recovery is limited by design. Keep it somewhere safe. Copy a username or password in one tap, and photos you attach shrink to fit automatically.

The assistant

What Holly can and cannot see

An assistant that reads your data should tell you exactly where it stops.

She reads your hubs. She cannot read your Vault.

Holly can see the hubs you'd expect her to work in: Finance, Home, Adventures, Health, Hobby Tracker, Business and Trading. That's how she answers "what's due this week?" from your own records instead of guessing.

Your Vault is outside that boundary entirely. It is encrypted on your device before it is saved, with a passphrase we do not hold, so there is nothing for Holly, or us, to read. It is never sent to her.

Where your data goes Your device sends data over an encrypted connection to Holvario, hosted in the UK. Only when you message Holly is that message passed to Google's Gemini API. Your Vault is encrypted on your device and is never sent to Holly. Your device You type it here Vault encrypted on-device Holvario Supabase · London (EU/UK) Encrypted in transit and at rest Holly Google Gemini API Not used to train models Your Vault stored as ciphertext · never sent to Holly ALWAYS ONLY WHEN YOU ASK
Nothing reaches Holly in the background. She sees a request only when you send one, and never your Vault.

Holly is powered by Google's Gemini API. When you send her a message, that message and the workspace information needed to answer it are processed by Google, who do not use it to train their models. She drafts changes for your approval and asks before changing anything. Full detail in the Privacy Policy.

Your data, your control

You can take it or delete it

Export your data

Download your records as CSV or a report whenever you want.

Delete your account

Close your account and remove your data on your terms.

Stored in the UK

Your account data lives in the EU/UK (Supabase’s London region) and stays there. The one exception is a message you send to Holly, which is processed by Google; see below.

UK GDPR-conscious

Built with UK GDPR principles in mind for how your data is handled.

Being straight with you: Holvario is in private beta. We only publish security claims we can stand behind, and we avoid words like "unhackable", "bank-grade" or "completely secure" because no system can promise that. If you have a security question or want to report an issue, get in touch. Responsible disclosure is welcome.

One life. One system.

Organised, and in your control.

7-day free trial · no card · from £12.99/mo.

Start free trial → See pricing