On June 23, Afina explained how the fast synchronization of personal and team accounts it recently added works. Accounts, proxies, cookies, and fingerprints are encrypted on the device before they are uploaded to the server. Afina’s servers store only encrypted data; the keys are never sent there, and the master password is kept in secure storage on the computer.
Only the owner can decrypt personal accounts, while team accounts can be decrypted only by team members. On a separate zero-knowledge page, the company adds that account passwords, seed phrases, cookies, API tokens, and IMAP data are encrypted with a local key before being written to disk. Extensions, RPA scripts, and Node.js modules are signed with Ed25519: if even one byte in a file changes, the runner will not launch it.
The downside of this setup is that a forgotten master password cannot be recovered; resetting it erases the encrypted data. Afina itself recommends storing the master password in a password manager or in a secure offline location. Cloud synchronization is optional: data can be kept locally, or users can connect their own Google Drive for backups. The page contains no links to an independent audit of this setup.
