Security Architecture & Local API Encryption
Firewire Analytics cannot trade or withdraw money: brokers are connected with read-only access keys, and the keys themselves are encrypted in your browser with your master password. Below is where the encrypted key is stored and when the server handles it in plaintext.
1. Strict Read-Only API Integration (Zero Trade or Withdrawal Rights)
Integration with brokerage APIs (BCS World of Investments, T-Investments, Finam, Freedom Finance (Tradernet), JetLend) relies strictly on Read-Only tokens. Reports from other brokers, such as VTB, are uploaded as files through the AI Copilot — no account access key is needed for that:
- No Fund Transfers: Keys cannot authorize withdrawals, payouts, or transfer requests.
- No Trading Permissions: The system has zero capability to execute market or limit orders.
- Analytical Read Access Only: Only asset positions, balances, historical trade logs, and dividend/coupon events are processed.
2. In-Browser Key Encryption: AES-256-GCM with Your Master Password
Broker API keys and tokens are encrypted on your device before they are stored anywhere:
- Key from your master password — PBKDF2-HMAC-SHA-256, 600,000 iterations: the password and a random 16-byte salt produce a 256-bit encryption key that the browser does not allow to be exported.
- Encryption — AES-256-GCM (Web Crypto API): a fresh random initialization vector for every encryption plus an integrity check, so a wrong password or tampered data fails to decrypt.
- Older keys: keys saved by the previous version with an extra "Kuznyechik" layer can still be decrypted; new keys are encrypted with AES-256-GCM only.
3. Where the Encrypted Key Is Stored and When the Server Sees It
Your master password never leaves the browser and is never stored. The encrypted key (blob) is kept in the browser (localStorage), and you choose the storage mode when connecting a broker:
- Local Only: the blob exists only in this browser; after clearing site data you will need to enter the key again.
- Cloud Vault: the same encrypted copy is saved to your account so the connection works on other devices. The server stores the blob but does not know your master password.
- 24/7 Auto-sync: for background updates the server keeps a copy of the key encrypted with a server key (envelope encryption) and decrypts it itself.
During a sync the browser decrypts the key and sends it to the server over TLS. The server uses it only to read data from the broker and processes the plaintext token in memory, while the broker session is stored with envelope encryption under a server key and a limited lifetime.
4. Public Portfolio Masking & Sharing Security
When sharing public Bento pages with subscribers, balance masking ensures total monetary values are hidden while demonstrating portfolio allocation percentages and TWR/XIRR returns.