Caution
NOT READY FOR USE — UNDER ACTIVE DEVELOPMENT.
Sanctum is a privacy-first vault for your money and crypto, running fully offline on a local encrypted database. Everything runs on hardware you control: encrypted storage, no telemetry, no accounts, no corporate cloud. You hold the keys, the database, and the backups — nobody else.
Today it targets desktop; the Android port is in progress. The roadmap then adds your own Sanctum server, so one private vault can be shared across all your devices — desktop, Android, and any browser (including iOS) — over your own network.
It is built for people who want a single, auditable place to track their finances without handing their financial life to a third party.
Net worth and trend analytics across your finances and crypto in one view.
Accounts, categories, transfers, and a complete transaction ledger, with multi-currency support (USD, CLP, EUR, and more).
- Wallets, trades, and swaps with automated portfolio balancing.
- Privacy-preserving price sync via CoinGecko, with proxy / Tor support.
- Offline tax engine for Chile (SII), the USA (IRS), and international jurisdictions, applying the right cost-basis method per local rules (FIFO, CPP, and more). See CRYPTO_TAX.md for the logic and legal foundations behind it.
- Encrypted backups (SQLCipher) with restore and rollback safety.
- JSON/CSV/TXT import with per-row validation and duplicate detection.
- Multi-language interface (EN/ES).
Sanctum is offline- and CSV-first — designed for travel and low-connectivity workflows. All imports are best-effort, validated per row, deduplicated, and make no network calls during ingestion.
Important
Every exchange/wallet file is processed locally on your device. Nothing is ever uploaded to a third party — the only server that exists is one you host yourself.
Supported formats:
- JSON (recommended) — full-fidelity format used by the Sanctum Generator.
- CSV — spreadsheet exports (separate files for transactions, crypto).
- TXT — prefixed, line-based notes for quick capture.
Exchange & wallet integrations:
| Integration | Status | Input | Notes |
|---|---|---|---|
| Kraken | Available | CSV (Ledgers, Trades) |
Upload one or both files for full spot coverage. |
| Binance | Available | CSV (All Statements, Spot Trade History) |
Balances, spot activity, and related ledger movements. |
| MEXC | Available | CSV (17 report types) | Spot, Statement, Funding, Fiat, Futures, and related exports. |
| NotBank (ex-CryptoMarket) | Available | CSV (Transaction, Trade Activity) |
Account movements and trading from Exchange Pro reports. |
| Feather Wallet | Available | CSV (history export) | Monero wallet history in Feather format. |
| Monero GUI Wallet | Available | CSV (history export) | Monero wallet history in Monero GUI format. |
Planned integrations
| Integration | Status | Input | Notes |
|---|---|---|---|
| Coinbase | Planned | CSV | Account statement and trade history flows. |
| Bybit | Planned | CSV | Spot/funding history exports. |
| OKX | Planned | CSV | Account and trade export formats. |
| KuCoin | Planned | CSV | Statement/trade CSV imports. |
| Bitget | Planned | CSV | Wallet and spot export reports. |
| Buda | Planned | CSV | Transaction/trade exports. |
| Orionx | Planned | CSV | Transaction/trade exports. |
| Exchange APIs (read-only) | Planned | API | Future direct sync — read-only, no trading/withdrawals. |
Sanctum rests on three pillars:
- No corporate cloud. No telemetry, no accounts, no third-party servers. Your data only ever lives on hardware you control — your device, or a server you host yourself.
- Hardened storage. SQLCipher (AES-256) encrypts the entire database with a master password you hold.
- Mitigated external connections. Price sync uses traffic padding to obfuscate your portfolio and supports user-configured proxies (SOCKS5/Tor, HTTP).
Note
Minimizing metadata is not the same as eliminating it: connecting to any external API inherently reveals your IP to that provider unless you route the traffic through a proxy.
Backups are encrypted at rest and ship with restore + rollback safety.
Available today — Sanctum runs as a native app on desktop (Linux, macOS, Windows), with a fully offline, encrypted database that lives only on that device. No server, no network required.
Planned — in roadmap order:
- Android — the native mobile port. In progress; the Tauri mobile toolchain and build commands are already wired up (see Android below).
- Self-hosted server — run your own Sanctum server as the single source of truth and share one vault across all your devices, reachable privately over your LAN or a mesh VPN like Tailscale, never exposed to the internet.
- Web app — browser access to that self-hosted server, which is what brings iOS and any other device along.
Important
There will never be a Sanctum cloud. The only server that will ever exist is one you run, on hardware you control.
Sanctum prioritizes performance, type safety, and auditability.
| Component | Technology | Role |
|---|---|---|
| Core | Rust | Business logic, validation, calculations. |
| Shell | Tauri 2 | Lightweight native shell with WebView. |
| Frontend | Svelte 5 + TS | Reactive UI with TypeScript and Vite. |
| Database | SQLite + SQLCipher | Locally encrypted relational storage. |
| Environment | Nix + Direnv | Reproducible, hermetic dev environment. |
The same Rust core is meant to power every target — desktop today, Android and the optional self-hosted server next — so the business logic lives in exactly one place.
Note
Full setup for Linux, macOS, and Windows — including the prerequisite toolchain — lives in the Installation Guide.
The repository ships an install.sh that builds from source and
installs Sanctum. On Linux it installs the binary, desktop entry, and icon; on
macOS it installs the binary only.
git clone https://github.com/yfloress/Sanctum.git
cd Sanctum
./install.sh --user # builds + installs to ~/.local, no sudoThis project uses Nix Flakes for a reproducible environment, plus Node.js and pnpm for the Svelte frontend. All commands run from the repository root:
direnv allow # or: nix develop
cd ui-svelte && pnpm install && cd .. # first time only
cargo tauri dev # run in development mode
cargo tauri build # build a production binaryNote
The Android port is still in progress. The toolchain and commands below work, but the mobile build is not yet considered usable.
With the Tauri mobile toolchain set up, build and run on a connected device:
cargo tauri android dev # run on a connected device (USB or wireless ADB)
cargo tauri android build # build a release APK / AABSee docs/INSTALL.md for the manual toolchain and platform-specific notes.
This project embraces open collaboration without compromising auditability.
- Human-led architecture. Privacy and data integrity are the priority, designed and directed by humans.
- AI-assisted development. Most of the code is written or refactored with frontier LLMs. A human specifies the patterns, the structure and the scope of every change, reviews the result, and nothing lands until it passes the project's gate:
cargo fmt,cargo clippy --workspace --all-targets -- -D warnings, and the full test suite. - Auditable by design. The full source is open for inspection — verify for yourself that there is no hidden telemetry.
Found a bug or have an idea? Use the Issue Tracker for bugs and feature requests.
Sanctum is currently in ALPHA. The encryption is industry-standard, but the software is under active development and may change without notice. Always keep backups of your recovery keys.
Open source under the GNU General Public License v3.0. See the LICENSE file for details.