RataSecurity
Rata keeps money data for families and friends. We design it so that a person who breaks into our server still cannot read your groups.
How Rata keeps your groups safe
-
Each group has its own random 256-bit key. The key is in the invite link after the
#sign. Browsers do not send that part of a link to a server. - Your device encrypts each expense, payment, note and bill photo with AES-GCM before it syncs. The server keeps only encrypted data, random IDs, times and a hash of an access token.
- To write to a group, a device must show a token that comes from the group key.
- Each group is separate. No data goes from one group to another, or from one install to another.
- Sign-in uses Google. The server keeps no passwords and no user table.
- All traffic uses HTTPS. Cloudflare hosts the app and the encrypted data.
What you must keep safe
The invite link opens the group. Share it only with the people in the group. If a wrong person gets the link, make a new group and move the people that you trust to it.
Report a security problem
Write to security@rata.fyi. Do not post the problem in public. We reply within 7 days.
These problems are in scope:
- Any way to read a group's data without its invite link
- Any way to write to a group without its invite link
- A leak of the group key to a server or to a third party