Security

00Customer financial data is private by default

This is WealthR's first security principle, adopted 3 September 2026, and it is written as an engineering rule rather than a promise:

• Private by default. Nobody at WealthR, and no AI tool WealthR uses, can browse your financial record. Day-to-day operations run on a database role that has no access to it at all.
• Only for a defined purpose. Your record can be opened only for a specific operational reason, such as a support issue you have raised.
• Minimum data. A support case exposes one section at a time (say, your pension pots), not the whole record. Founder dashboards and product analytics are built on pseudonymised aggregates with no names, emails or dates of birth.
• Authorised, time-limited, auditable. Every privileged access is tied to a case with a written reason, expires automatically, and is logged. Every statement a privileged role runs against the financial tables is also logged at the database level.

You can ask for the access log for your own account at any time by emailing privacy@wealthr.co.uk. If nothing has been opened, the answer is a short one.

01Where your data lives

WealthR runs on managed UK and EU infrastructure. The database is hosted by Supabase (Postgres) in an EU region, with daily encrypted backups. The app and API are hosted on Render with TLS-terminated edge servers. We picked these providers specifically because they handle the heavy compliance lifting (encryption, patch management, physical security) and let us focus on the app.

02Encryption — in transit and at rest

In transit. Every connection between your device and WealthR is encrypted with TLS 1.3 (or TLS 1.2 fallback for older browsers). HTTP requests are 301-redirected to HTTPS. We send the Strict-Transport-Security header so your browser remembers to only ever talk to us over HTTPS.

At rest. All database storage is encrypted with AES-256, with keys managed by the cloud provider (rotated automatically). Backups inherit the same encryption. If a disk is ever decommissioned, the data on it is unreadable without the keys — which we don't share.

Passwords. Passwords are never stored in plaintext. They're hashed with bcrypt before they hit the database — meaning even we can't read them. If you forget your password we can only send you a reset link, never tell you what it was.

03Your asset photos: end-to-end encrypted — even we can't see them

WealthR Pro lets you attach photos to your physical assets — a watch, a painting, inherited coins. Those photos are the one part of WealthR that could be genuinely sensitive if exposed, so they get the strongest protection we can offer: zero-knowledge, end-to-end encryption. Your photos are encrypted on your own device, before they ever leave it. WealthR's servers only ever receive and store scrambled ciphertext — we have no way to view your images, and neither would anyone who somehow gained access to our storage.

04How sign-in works

Authentication is handled by Supabase Auth — the same library used by thousands of production fintech and SaaS apps. When you sign in we issue a short-lived JWT (JSON Web Token) that your browser uses to identify itself to the API. Tokens auto-rotate; if one leaks, it's invalid within minutes.

• Email + password with bcrypt hashing, or Google sign-in
• Biometric sign-in (optional, per device) — Face ID, Touch ID, fingerprint or Windows Hello, via WebAuthn passkeys. Turn it on from Settings → Security; your login is sealed behind your device's own biometrics (the private key never leaves the device), and your password always still works as a fallback, so you can never be locked out.
• Password reset via signed time-limited email link
• Two-factor authentication (optional) — a six-digit code from an authenticator app (TOTP), set up in Settings → Security and asked for at every sign-in on every device
• Session tokens are held by the app in your browser's storage for wealthr.co.uk, the standard pattern for a single-page app on Supabase Auth. They are short-lived, rotate automatically and are cleared on sign-out. Because the browser can read them, the defence is keeping other scripts out: a Content-Security-Policy on every page, and every piece of text you enter escaped before it is drawn. We do not currently use HttpOnly cookies for sessions; doing so needs a server in front of the app and is on the list
• Rate limiting on sign-in and reset endpoints to slow brute-force attempts

05Why we don't link to your bank

Most UK finance apps connect via Open Banking — which means a third-party aggregator (Plaid, TrueLayer, Yapily) holds a long-lived token that lets them read your transactions. That token is a target. If the aggregator is breached, every connected app is breached.

WealthR is manual entry. You type your totals once a month. We never ask for, see, or store your bank credentials, sort code, account number, or transaction history. The blast radius of a WealthR breach is therefore limited to the figures you chose to share — not your real-time spending or account access.

This is a deliberate trade-off: it costs you 90 seconds a month of typing in exchange for materially less attack surface than any aggregator-based competitor.

06Application security

• Row-level security (RLS) enforced at the database layer — every query is scoped to the signed-in user's ID. A bug in the app can't expose another user's data because the database itself refuses.
• Content Security Policy (CSP) headers on every page to mitigate XSS and clickjacking.
• Input validation on every API endpoint with strict schemas — no free-text SQL anywhere.
• Dependency monitoring via automated GitHub Dependabot alerts. Critical CVEs are patched within 48 hours.
• Secret management — API keys and secrets live in the platform's encrypted environment variables, never in source code.
• Audit trail & version history — every change to your records is captured with who made it, when, and what changed. A full version history is retained, so any previous state can be recovered — and the trail is kept for 7 years for record-keeping.

ADVAdviser Workspace & client portals

When a financial adviser or firm uses WealthR to manage their clients, the same foundations above apply — plus protections specific to handling client data on a firm's behalf:

• Per-firm isolation. Every firm's clients are separated at the database layer by row-level security, so one firm can never see another's data, and a colleague only sees the clients they're permitted to.
• PIN-protected portals. Each client portal link requires a numeric PIN that isn't derived from the client's data and is shared separately from the link. After repeated wrong attempts the portal locks for a cooldown period — blocking guessing, even of a forwarded or intercepted link.
• Private document vault. Documents live in a private store that is never publicly reachable. Uploads and downloads happen only through short-lived signed links (download links expire within two minutes), and every request is access-checked before anything is served. Files can be set to auto-delete on a retention schedule, and every removal — manual or automatic — is recorded in an audit trail.
• Per-firm storage limits. Each firm has a storage allowance, preventing any one firm from exhausting shared capacity.
• Full audit trail & recoverable history. Every change an adviser makes to a client's records is recorded — who made it, when, and what changed — and a complete version history is retained for 7 years, so any earlier state can be reproduced and reviewed. Together with daily encrypted backups and point-in-time recovery, a firm can always evidence exactly what a client's plan looked like on any given date.
• Branded emails carry no figures. Emails to a firm's clients contain only a name, a short message and a secure link — never financial values — with anti-spam safeguards and sending limits, and clients can opt out of notifications while still using the portal.
• Invite-only access. Joining a firm's workspace is by invitation from the firm's administrator; the branded sign-in does not allow open self-registration.

Where WealthR processes client data for a firm it does so as the firm's data processor, under a separate Data Processing Agreement. See our Privacy Policy for the controller/processor split.

07Backups and recovery

The database is backed up automatically every day, with point-in-time recovery so we can roll back to a precise moment if something goes wrong. Backups are encrypted and stored separately from the live database. If a disaster takes out the primary, we can restore to a working state within hours, not days.

Separately, WealthR keeps a full version history of every change to your records, retained for 7 years — so any earlier state can be recovered, and there is a complete, time-stamped record of what changed and when.

You can also export your own data at any time from the app — see Settings → Export data. We give you a clean JSON file containing every figure you've ever entered. Your data is yours; we won't hold it hostage.

08Responsible disclosure

09What we ask of you

Security is a shared responsibility. The single biggest determinant of your account safety is your own password hygiene.

• Use a unique password. A password manager (1Password, Bitwarden, Apple Passwords) makes this effortless.
• Don't reuse passwords from breached sites. Check haveibeenpwned.com if unsure.
• Keep your devices and browsers up to date — most real-world account takeovers happen via outdated software, not server breaches.
• Be cautious of phishing. WealthR will never ask for your password by email. Sign-in is always at https://wealthr.co.uk.

10GDPR and your rights

WealthR Ltd (company number SC900929) is a UK GDPR data controller. You have full rights under the UK GDPR including access, rectification, erasure (right to be forgotten), portability, and objection. The full breakdown — including how to exercise each right — is on our privacy policy.

To delete your account and all associated data, go to Settings → Account → Delete account, or email privacy@wealthr.co.uk. Deletions are permanent and processed within 30 days (UK GDPR-compliant); usually faster.

11Things we will never do

• Sell, share or rent your data to advertisers, brokers or anyone else. Ever.
• Ask for your bank login, card PIN, or one-time codes by email.
• Run third-party tracking pixels or ad networks on the app.
• Use your financial data to train AI models.
• Make changes to your account on your behalf without explicit consent.
• Open your financial record without a logged, time-limited support case with a written reason.

12Get in touch

For security reports use the dedicated address. For general queries the support inbox is fine — both go to the same person.

This page is informational and reflects our current implementation. It is not a contract; the legally binding documents are our terms and privacy policy. We update this page whenever the underlying practices change — last updated 1 July 2026.