What Data Does Your Portfolio Contain?
- Domain names you're negotiating to buy or sell
- Purchase prices and sale prices (your profit margins)
- Expiry dates and renewal costs
- Registrar account associations
- Buyer and seller contact history
This is a complete picture of your investment strategy. If a competitor saw it, they could outbid you on domains you're targeting, undercut your prices, or time their own outreach to disrupt your deals. If a bad actor accessed it, the financial exposure is real.
Why Most Portfolio Tools Are a Privacy Risk
Most domain portfolio tools - spreadsheets, generic CRM platforms, or basic domain managers - store your data in plaintext on their servers. That means the service provider can read it. Their employees can access it. A data breach exposes it. A subpoena compels disclosure of it.
For casual hobbyists, that may be acceptable. For serious investors managing large portfolios with significant unrealized gains, it's an unacceptable risk.
What End-to-End Encryption Actually Means
End-to-end encryption (E2EE) means data is encrypted on your device before it's sent anywhere. The server - and therefore the service provider - only ever sees encrypted data. They cannot read your portfolio contents even if they wanted to, and a breach of their servers exposes nothing readable.
This is distinct from "encryption at rest" (encrypted on the server but the provider holds the keys) or "encryption in transit" (HTTPS). True E2EE means only you hold the keys.
How DNFolder's Envelope Encryption Works
DNFolder uses a two-layer key architecture:
- Data Encryption Key (DEK): A random key generated once during signup. Your portfolio data is encrypted with this key using AES-256-GCM.
- Key Encryption Key (KEK): Derived from your password using PBKDF2 (310,000 iterations). The KEK wraps (encrypts) your DEK. Only the wrapped DEK is stored on the server.
When you log in, your password derives the KEK locally in your browser, the KEK unwraps the DEK, and the DEK decrypts your data. The plaintext never leaves your browser. Our servers never see it. This architecture is described in more detail on our security page.
The Recovery Key System
Because we can't recover your data (we don't have the keys), DNFolder generates a Recovery Key at signup. This key independently unlocks your DEK - so if you forget your password, you can restore access without our help and without a support ticket. Store your Recovery Key in a password manager.
Why This Matters for Serious Investors
Domain investing is competitive. Your acquisition targets, pricing strategies, and buyer relationships are your edge. Protecting that information is as important as any other business security practice. NamePros and the domain community broadly have discussed data privacy as an underappreciated risk for portfolio investors.
With DNFolder, you get the utility of a full-featured portfolio tracker - RDAP lookup, expiry alerts, analytics, sales pipeline - with the privacy guarantees that most tools can't offer.
Your portfolio is private. It should stay that way.
DNFolder uses AES-256-GCM end-to-end encryption. Only you can read your data. Free tier available - no credit card required.
Start Free