Your Home Accounts is built around a single principle: your financial life belongs to you, and only you. Your bank balances, transaction history, mortgage details, insurance documents, and receipts never leave your devices in a form anyone else can read. This document explains, in plain language, exactly how that protection works — from the moment you open the app to the moment you close it.
When you add an account, record a transaction, or import a document into the vault, Your Home Accounts saves that information in two places:
There is no separate server run by Your Home Accounts. The app has no back end. There is no account to create, no username, no company database holding your records.
Think of encryption as turning your data into a completely unreadable scramble — like a document put through an industrial shredder, except the pieces can be perfectly reassembled, but only by someone who holds the exact right key. Without the key, the scrambled data is useless.
Your Home Accounts uses AES-256-GCM, which stands for Advanced Encryption Standard with a 256-bit key in Galois/Counter Mode. Here is why that matters:
This is the strongest encryption commercially available.
Everything. Every time the app saves, all of the following is encrypted before being written to disk or iCloud:
The file that sits in your iCloud folder is not a readable financial record. It is an encrypted block of data that looks like random noise to anyone without your key.
Decryption happens entirely on your device, in memory, when you open the app. The decrypted data is never written back to disk in readable form — only the encrypted version is ever stored.
When you first launch Your Home Accounts, the app generates a random 256-bit encryption key — a unique string of bits created fresh for your installation, never transmitted anywhere. This key is generated using your device's hardware random number generator, which Apple builds into every iPhone, iPad, and Mac.
The key is immediately saved into the Apple Keychain — Apple's built-in, hardware-protected secret store. The Keychain is separate from your regular file system. On devices with a Secure Enclave (all modern iPhones, iPads, and Apple Silicon Macs), Keychain secrets can be protected in a dedicated security chip that is physically isolated from the main processor. Even if an attacker somehow gained full access to your device's storage, they could not extract Keychain secrets without also defeating Apple's Secure Enclave.
The key is stored with the setting "accessible after first unlock" — meaning it is available as soon as you have unlocked your device once after a restart, which is when you would naturally open the app anyway.
If you use Your Home Accounts on both your iPhone and your Mac, both devices need to be able to read the same encrypted data file. To make that possible, the encryption key is shared between your devices using iCloud Keychain — Apple's encrypted, end-to-end-protected synchronisation service for Keychain items.
iCloud Keychain uses its own independent encryption before any data leaves your device. Apple cannot read the contents of iCloud Keychain, and neither can anyone else. When your iPhone generates the key and saves it to iCloud Keychain, your Mac receives the same key — and both devices can decrypt your data file without it ever travelling over the network in a readable form.
The trade-off to understand: If someone were to gain complete, persistent access to your iCloud Keychain — for example, through your Apple ID credentials — they could in theory obtain the encryption key. This is why your Apple ID password and two-factor authentication are themselves an important part of your security posture. Your Home Accounts protects your data as strongly as Apple protects your iCloud Keychain.
Encryption protects your data on disk and in iCloud. The app lock protects it from anyone who picks up your unlocked device while the app is open.
When you set a password in the Security settings, the app will lock itself whenever you leave it. To get back in, you must either enter your password, or use Face ID, Touch ID, or your Mac login password.
Your Home Accounts uses Apple's LocalAuthentication framework — the same framework that banking apps, payment apps, and Apple Pay itself use. When you authenticate with Face ID or Touch ID, the app never sees your biometric data. Your fingerprint or face scan is evaluated entirely inside the Secure Enclave on your device. All the app receives back is a simple yes or no answer. Your biometric data never leaves the chip.
The simplest way to check a password is to store it and compare what you type with what was stored. But if an attacker got access to your Keychain, they would find your password sitting there in readable form. A slightly better approach is to store a hash — a mathematical one-way transformation. But standard hashes (like SHA-256) are designed to be fast, which means an attacker with a powerful computer could try millions of guesses per second until they found a match.
Your Home Accounts uses PBKDF2 (Password-Based Key Derivation Function 2) — a deliberately slow algorithm designed specifically for password storage. Here is what makes it different:
Even with PBKDF2 making each guess expensive, the app adds a second layer of protection: progressive lockout. After each wrong password attempt, the app enforces a waiting period before you can try again:
| Failed attempts | Wait time |
|---|---|
| 1st wrong guess | 5 seconds |
| 2nd wrong guess | 30 seconds |
| 3rd wrong guess | 5 minutes |
| 4th wrong guess | 15 minutes |
| 5th and beyond | 1 hour |
A countdown is shown on the lock screen so you know exactly when you can try again. The Unlock button is disabled during the wait — there is no way to skip it. At one hour per guess, trying even a small dictionary of common passwords would take years.
Biometric authentication (Face ID/Touch ID) is not affected by this counter — its own lockout is managed by Apple's Secure Enclave at the hardware level.
On both iPhone and Mac, you can view recently used apps without fully closing them. When the system takes a snapshot of your app for this preview, it captures whatever was visible on screen at that moment. Without specific protection, a snapshot of your accounts and balances could appear in the App Switcher — visible to anyone glancing at your screen.
Your Home Accounts detects the instant the app moves out of active focus — even before it fully enters the background. At that precise moment, the app replaces its entire contents with an opaque cover screen showing only the app's lock icon. This cover appears before the system can capture a screenshot for the App Switcher.
When you return to the app and it comes back into focus, the cover disappears. If the app has been fully backgrounded, it will show the lock screen and require authentication as normal. The result: the App Switcher preview of Your Home Accounts will always show the lock icon, never your financial data.
When you import a PDF, bank statement, receipt, or other file into the Document Vault, Your Home Accounts does not simply copy and store it. It encrypts the file using the same AES-256-GCM algorithm described in Section 2. The encrypted file is saved alongside your other data in iCloud. Even if someone were to browse your iCloud storage at the file level, they would see only encrypted data — not readable documents.
When you open a document within the app, it is decrypted on the fly into a temporary location in the app's private memory area. The permanently stored version on disk is always the encrypted form. The same applies when you use the Share button to send a document to another app or person — the app decrypts a temporary copy first, then shares the readable file, exactly as if you had opened any normal document on your device.
The app's built-in protections are strong, but security is always a shared responsibility. Here are the most important steps you can take:
| Protection | Technology | What it guards against |
|---|---|---|
| Data encryption at rest | AES-256-GCM | Reading data from disk or iCloud storage |
| Encryption key storage | Apple Keychain + Secure Enclave | Key extraction from the device |
| Cross-device key sync | iCloud Keychain (end-to-end encrypted) | Key interception in transit |
| App lock | Password + Face ID / Touch ID | Access on an unlocked device |
| Password storage | PBKDF2, 150k iterations, random salt | Password cracking from a stolen Keychain item |
| Constant-time comparison | XOR-fold algorithm | Timing-based password inference |
| Brute-force lockout | Exponential backoff (5s → 1hr) | Automated password guessing on the lock screen |
| App Switcher cover | Immediate opaque overlay on inactive | Screenshot capture of financial data |
| Document encryption | AES-256-GCM per file | Reading imported files from disk or iCloud |
Your financial data is your business. Your Home Accounts is designed so that it stays that way.