Skip to content

Turbobulls

Back to all articles
Security

Verify Our Encryption Yourself in 60 Seconds

Most privacy claims cannot be checked. This one can. A step-by-step guide to confirming that your transactions leave your browser encrypted, using tools already built into it.
Verify Our Encryption Yourself in 60 Seconds
Every portfolio tracker says your data is safe. Almost none of them let you check. Because Turbobulls encrypts in your browser, you can watch it happen - and confirm that the numbers you typed are not in what we receive.
Here is the awkward truth about privacy policies: they are promises, and you have no way to audit them. You read the page, you decide whether the company seems trustworthy, and that is the entire basis of your decision. This guide replaces that guesswork with a test. It takes about a minute, needs nothing but your browser, and tells you definitively whether your financial data leaves your machine readable.
No technical background needed. You will not write any code. You will open a panel that is already in your browser, save one transaction, and search for a number. If you can use a search box, you can do this.

Before you start

You need a workspace you can write to - a free trial workspace is fine. The demo will not work for this test, because it is read-only and never saves anything. Any modern browser works: Chrome, Edge, Brave, Firefox or Safari.

The check, step by step

1

Open the Network panel. Press Cmd+Option+I on a Mac, or F12 on Windows and Linux. Select the Network tab, tick Preserve log, and set the filter to Fetch/XHR so you see data requests rather than images and scripts.

2

Save a transaction with a number you will recognise. Use an amount you would never normally type, such as 1234.56. If there is a note field, write something equally distinctive like verify-test-9x7q. The point is to create strings that exist nowhere else, so that searching for them later actually proves something.

3

Find the request. A request to /api/graphql appears in the list. Click it and open Payload in Chrome, or Request in Firefox. Saving a transaction sends a mutation called push, or sync if several changes are sent together. Either is fine.

4

Read what was actually sent. Look inside variables.input for the events array. Compare what you find with the two payloads below.

A typical tracker sends
{
  "amount": 1234.56,
  "ticker": "AAPL",
  "note": "verify-test-9x7q",
  "date": "2026-07-27"
}
Readable by the server, its staff, and anyone who reaches the database.
Turbobulls sends
{
  "action": "transaction added",
  "encrypted": "k3JhbmRvbS1sb29raW5nIGJhc2U2...",
  "iv": "9tK2fQ7xW1pL4mNz",
  "created_at": "2026-07-27T14:22:31Z"
}
Your amount, ticker and note are not in there. Nothing to read.
Before the field names, the thing worth knowing: that encrypted blob is not only transactions.
Everything inside a workspace is encrypted
TransactionsAccountsBalancesBudgetsAssigned amountsCategoriesBrokersTagsCustom assetsNotes

Not just trades. Everything you create is stored as one of these encrypted records, so the figures and labels inside them are unreadable to us in exactly the same way.

A few things in the payload are worth understanding:
  • The encrypted field holds the payload itself. Save the same transaction twice and the value is completely different both times, because a new initialisation vector is generated for every record.
  • The initialisation vector is what makes that possible - twelve bytes, fresh every time, which is why identical transactions never produce identical ciphertext.
  • The action is a short label saying what kind of thing happened, and it is deliberately not encrypted - the server has to know something occurred in order to sync it, without knowing what it was. In the real payload it appears as a brief internal name rather than a sentence.
  • The timestamp and a few identifiers are routing and ordering metadata, also not encrypted.

The step that settles it

Reading a payload tells you what is there. The next step tells you what is not there, which is the part that matters.
1

Open the global search. Press Cmd+Option+F in Chrome, or click the magnifier icon in the Network panel toolbar.

2

Search for your amount. Type 1234.56 and look at the results. Then search for your note, verify-test-9x7q.

What you should see
Zero matches in any request body. The amount you typed and the note you wrote do not appear anywhere in what your browser sent us. Not obscured, not hashed, not tucked into a header. Absent.
That is the entire claim, and you have now tested it rather than believed it.

Check the return journey too

Reload the page and look at the sync response. Your events come back as enc and iv as well. The readable version only ever exists after your browser decrypts it, using a key derived from your workspace password - which we never receive.

What else you will notice

If you keep looking, you will find three things we would rather explain than have you discover on your own:
  • The kind of action is readable. Someone with database access can tell that you added a wallet transaction at 14:22. They cannot tell what it was.
  • Price requests name the instruments. Prices are public data and have to be fetched by name, so those names travel with the request rather than encrypted. They are not logged, not stored against your account, and not used for anything beyond returning the prices. Quantities, prices paid and dates stay encrypted, so a name on its own says nothing about your position.
  • Your local database holds readable data. Open Application, then IndexedDB, and you will find decrypted records. That is deliberate - it is what makes the app work offline. Encryption protects your data on our servers, not against something that already controls your device.
Why we list these ourselves
A privacy claim that only mentions its strengths is marketing. These are the limits of ours, written down before you went looking for them, and they are covered in the same detail on our encryption page.

What this proves, and what it does not

It proves that the code running in your browser right now encrypts your data before sending it. That is a real, checkable fact, and very few products in this category can offer you one. It does not prove anything about the version we serve next month. Turbobulls runs in a browser, so the code arrives fresh on each visit. No web application can honestly claim otherwise. What the check does is narrow what you have to trust: from everything we tell you down to the build we serve today. That is a genuine reduction rather than a complete one - and unlike an audit that happens once a year, you can repeat this any time, on any release, in about a minute.

Reporting a security issue

Security reports go to security@turbobulls.com. We acknowledge within 72 hours, assess within 7 days, publish what changed, and credit the person who found it.
Quick Links
How the encryption works, algorithm by algorithmYour data, your device, your businessWhy encryption matters for financial data

Start tracking →

Get these by email

One useful investing metric, properly explained. No spam, unsubscribe anytime.

Read more

Why End-to-End Encryption Matters for Your Financial Data

Why End-to-End Encryption Matters for Your Financial Data

Most portfolio trackers can see your holdings, balances, and transactions. Here is why that is a problem and what real end-to-end encryption looks like.

Your Data, Your Device, Your Business

Your Data, Your Device, Your Business

We can't see your financial data - and we like it that way. With on device encryption even our servers are in the dark.

Max Drawdown Explained: The Worst Drop You've Lived Through

Max Drawdown Explained: The Worst Drop You've Lived Through

Max drawdown is the largest fall in your net worth from a previous peak to a later low, as a percentage. Learn what it means, how Turbobulls calculates it, and how to use it to gauge your real risk tolerance.