The web app only runs on HTTPS so local expense data can be protected with the browser's secure crypto APIs.