Security Architecture & Local API Encryption
Firewire Analytics is architected on **Zero-Trust & Zero-Knowledge** principles. We protect your portfolio data with Read-Only API restrictions and client-side GOST + AES-256 cascade encryption.
1. Strict Read-Only API Integration (Zero Trade or Withdrawal Rights)
Integration with brokerage APIs relies strictly on Read-Only tokens:
- No Fund Transfers: Keys cannot authorize withdrawals, payouts, or transfer requests.
- No Trading Permissions: The system has zero capability to execute market or limit orders.
- Analytical Read Access Only: Only asset positions, balances, historical trade logs, and dividend/coupon events are processed.
2. Cascade Encryption: GOST R 34.12-2015 + AES-256-GCM
All sensitive tokens undergo client-side dual-layer encryption:
- Layer 1 — GOST R 34.12-2015 ("Kuznyechik"): 256-bit symmetric cipher resilient against quantum and spectral attacks.
- Layer 2 — AES-256-GCM: Ensures global data authenticity and tamper-resistance via Galois/Counter Mode.
- Streebog-512 Key Derivation (GOST R 34.11-2012): User passwords are converted into cryptographic keys using high-entropy hashing.
3. Master-Password Isolation & Local Browser Storage
Your master password never reaches our servers in plaintext. Decryption occurs strictly inside your local browser sandbox (WASM / Web Crypto API), keeping your keys safe.
4. Public Portfolio Masking for Bloggers & Creators
When sharing public Bento pages with subscribers, balance masking ensures total monetary values are hidden while demonstrating portfolio allocation percentages and TWR/XIRR returns.