Encryption

Argo Books uses AES-256-GCM encryption to protect your business data. This is the same encryption standard used by banks and military organizations worldwide, and is considered one of the strongest available.

When Encryption Is Active

Encryption is switched on by setting a password on your company file. Your password is what the encryption key is built from, so until you set one there is no key and the file is not encrypted.

A company file with no password is not encrypted. It's compressed, which is not the same thing: anyone who gets hold of the file can read everything in it without needing a password or any special tools. If your company file contains real business data, set a password.

There is nothing else to configure. Once a password is set, every save from that point on is encrypted automatically, and the file is decrypted only in memory while you have it open.

How It Works

When you save, Argo Books encrypts your data before writing it to disk. When you open a password-protected company file, the data is decrypted in memory so you can work with it normally. The copy on disk stays encrypted the whole time.

  • AES-256-GCM: Advanced Encryption Standard with 256-bit keys and Galois/Counter Mode, providing both confidentiality and data integrity. If a file has been tampered with, decryption fails rather than handing you altered data.
  • PBKDF2 key derivation: your encryption key is rebuilt from your password each time using PBKDF2-SHA256 with 600,000 iterations and a unique random salt.
  • The key is never stored: Argo Books doesn't keep your encryption key anywhere, not in the file and not on your computer. It's derived from your password when needed and wiped from memory immediately after.
  • Local only: encryption and decryption happen entirely on your device. Your company file, password, and key never leave your computer and are never sent to us.

What Gets Encrypted

Argo Books doesn't pick and choose which fields to protect. Your whole company file is packed into a single archive and that entire archive is encrypted in one piece, so everything inside it is covered:

  • Financial transactions (expenses, revenue, payments)
  • Customer and supplier information
  • Product and inventory data
  • Invoices and purchase orders
  • Attached receipts and documents
  • Your settings, reports, and everything else stored in the file

Who can decrypt your file

Your password is the everyday way in, and it's the only one that works on your own computer. Nobody can work it out from the file: it isn't stored, it's used to build the encryption key and then discarded.

There is one other way in. From version 2.0.11, each encrypted file also stores its key wrapped under an Argo Books recovery key, so that forgetting a password doesn't have to mean losing your books. That key is held offline by us and is useless without your file, so it only ever comes into play if you send us your file and ask us to unlock it. Full details, including what we check before unlocking, are on the Password Protection page.

Esc