The word does a lot of hiding
“Encrypted” usually means one of two things.
Encrypted in transit means the connection between your device and the company's servers is scrambled, so somebody sharing your café's wifi cannot read it. This is table stakes. Every site with a padlock does it. It says nothing about what happens once the data arrives.
Encrypted at rest means the data sits on their disks in scrambled form. This protects against a stolen hard drive, or a backup left somewhere it should not be. It is genuinely useful. But the company holds the key — it has to, because it needs to read your data to show it back to you, index it, analyse it, or answer a subpoena about it.
Both are protections against outsiders. Neither is a protection against the company.
That distinction rarely matters for a photo-sharing app. It matters a great deal for a service that knows what you earn, what you owe, what you are worth, and what you are worried about.
What changes with zero-knowledge
Zero-knowledge means the key is derived on your device, from something only you know, and never leaves. The data is scrambled before it crosses the network. What arrives at the server is ciphertext, and the server has no way to turn it back into anything.
The practical test is a thought experiment. Suppose the company's entire database leaked tomorrow, every row of it, published online. What would the attacker have?
With encryption at rest: everything, if they also got the keys — and the keys live in the same infrastructure, which is why breaches so often expose both.
With zero-knowledge: rows of noise.
The same test applies to the company itself. A support agent who wants to look at your balances cannot. An engineer running a query cannot. A future owner who buys the business and changes the privacy policy cannot. A court order compelling the company to hand over your records gets ciphertext, because there is nothing else to hand over.
That last one is worth sitting with. It is not a promise about behaviour — promises change when companies do. It is a statement about capability. The company cannot break a promise it is architecturally incapable of keeping or breaking.
What it costs you
This is the part usually left out, so here it is plainly.
Forgetting your password is different. If the key is derived from something only you know, and you lose it, nobody can reset it for you. “Forgot password” as you know it — a link that lets a company restore your access to data it can read — is not possible. What replaces it is a recovery mechanism you set up in advance and store somewhere safe. If you lose both, the data is genuinely gone.
Server-side features get harder. Searching, sorting and summarising are easy when a server can read your data and hard when it cannot. Work has to happen on your device, or with clever cryptography, or not at all. Some features are simply more awkward to build this way.
You have to take the architecture on trust, or check it. “Zero-knowledge” is a claim, and the only way to verify it is to look — at published technical documentation, at an independent audit, at open-source client code. A company that says the words but will not show you how it works is asking for the same trust as everyone else, in better vocabulary.
Why anyone bothers
Because the alternative business model is visible once you look for it. Account-aggregation apps that are free to use are generally monetising the data — selling anonymised spending patterns, or referring you to products that pay them. That is a legitimate way to run a business, and it is disclosed in the privacy policy. It is also structurally incompatible with not being able to read your data.
Which means the question to ask any service holding your financial life is not “is it encrypted?” Everything is encrypted. The question is narrower:
The question worth asking
If your database leaked tomorrow, what would the attacker be able to read — and can you, the company, read it yourselves right now?
The answer tells you which kind of encryption is on offer, and therefore what you are actually trusting: a company's architecture, or a company's promises. Both can be reasonable. They are not the same thing, and only one of them survives a change of ownership.
You can read how Tessera answers that question on our security page, including the specific algorithms and what the server stores.
Tessera is an information tool, not financial advice. Advice comes from the FCA-authorised advisers you invite.