Security
Hesafi keeps your books in the app on your phone or computer, and nowhere else unless you copy a backup.
What you see and type.
Hesafi runs here, in your browser or the installed app. Once it has loaded, it works offline.
Backups are locked with AES-256-GCM before they leave the device. Only your passphrase or recovery key opens them.
Your books: a database in your browser's private storage on this device. Every entry is sealed to the one before it.
Your phone. Lose it without a backup, and the books on it are gone.
The capsule is a backup you made: a sealed copy you keep off the phone.
caseledgersealappscreen
The border
Everything on the left stays on your phone or computer. Each thing on the right leaves only when you do something, and we list every field it carries.
Stays on your device
unless you copy a backup yourself
Crosses only when you act
Manifest 01
{
"licenseKey": "HSFK-7Q2K-…",
"deviceId": "c1f0…",
"label": "Chrome on Android",
"country": "ke",
"termsVersion": "2026-10-24",
"consent": true
}authorization: License HSF1.…Sample values. Field names as the app sends them.
Manifest 02
{
"task": "transactions.categorize",
"mode": "fast",
"input": {
"transactions": [
{
"id": "1",
"date": "2026-10-02",
"description": "KPLC PREPAID",
"amount": -100000
}
],
"accounts": [
{
"code": "6100",
"name": "Electricity",
"type": "expense"
}
]
},
"units": 1,
"requestId": "6f1c2b7e-3d4a-4c5b-9e8f-0a1b2c3d4e5f"
}Sample values. Field names as the app sends them.
Manifest 03
{
"catalogKey": "paystack:std-ke",
"email": "you@…",
"businessName": "…",
"phone": "07…",
"country": "ke",
"termsVersion": "2026-10-24",
"deviceId": "c1f0…"
}Sample values. Field names as the app sends them.
Manifest 04
No request of ours to show: Google or Facebook handle the sign-in page.
This website, not the app, measures our ads with Meta, as our Privacy notice explains.
Backups
Backups are free forever, on every plan.
Verify books
Every saved entry is sealed together with the one before it. If anything is edited, deleted or reordered behind the app's back, Verify books shows where. Real mistakes are fixed with a reversal, so both entries stay on record.
Verify books: all 5 entries check out.Verify books: entry 03 doesn't match its seal. It was changed after it was saved.
Sample entries. The seals are real SHA-256, made by the same code the app uses.
The trade-off
If you lose your phone, clear your browser's data, or forget both your passphrase and your recovery key, the books on that device are gone. We can't see them, so we can't restore them.
Three habits
On iPhone, add Hesafi to your home screen. Safari can clear a website's data after 7 days without use.
Under the hood
| What | How |
|---|---|
| Where the books live | A SQLite database in your browser's private file storage (OPFS) on this device. One tab writes at a time. |
| Backups | A .hesafi file encrypted with AES-256-GCM. Its key is wrapped twice: by your passphrase (PBKDF2-SHA256, 600,000 rounds) and by a 160-bit recovery key. The header is authenticated, so tampering is detected. |
| Entries | Each entry is sealed with SHA-256 together with the previous entry's seal. Saved entries can't be edited or deleted, only reversed. Past periods can be locked. |
| Licence | Signed by us with Ed25519 and checked on your device every time Hesafi opens, so it works offline. |
| AI | Only the lines you pick, sent through our server to an AI service provider that may not train on them or keep them. Our server's request logging is off. |
| What our servers keep | Licences and their devices, AI credit balances, hashed emails, payment references, and the Terms version you accepted. |
| Payments | M-PESA and cards through Paystack. We never see your M-PESA PIN or card number. |
| Statements you import | Read on your device and never uploaded. Files are size-checked before they're opened. |
| This website | Measures our ads with Meta, as the Privacy notice explains. The app's pages have no ad pixel. |
Invoices and basic books are free forever. No card needed. Questions? Message us on WhatsApp.
