Security
Security, stated plainly.
In place today, each with its audit reference.
In place today
| Control | As at | Audit reference |
|---|---|---|
| Second step at sign-in | 1-2 second factor, O8 step-up | |
| Strong passwords | 4 passwords, O5 leaked-password protection | |
| Bot protection | 3 bot protection | |
| Sessions that end | 5-6 sessions | |
| New-device alerts | O15 new-device alerts | |
| Data isolation | 8 data isolation | |
| Encrypted bank tokens | 9 secrets, AES-256-GCM bank tokens | |
| Private documents | 10 documents | |
| Sharing you control | 12 dashboard sharing, anonymous share link | |
| Advisors verified | 13 advisor access | |
| A read-only AI connector | tracker/AI-Connector.md hard rules 1-6 | |
| Your data is yours | O3 data rights, tracker/Privacy-Mode.md | |
| Where your data is held | O21 data residency statement |
Where your data is held
Your account data, records and uploaded documents are stored in a database and file store run by Supabase in Mumbai, India. The application's server functions run on Vercel, set to run in Mumbai, India. We do not currently offer a choice of region. Other service providers, some used only when you use a feature, are listed with their location on the service-providers page.
Not in place yet
No independent audit or penetration test yet · Not end-to-end encrypted · No live bank connections · Recovery is not yet proven · No choice of region yet · Passkey re-check