Security

01Where your data lives

WealthR runs on managed UK and EU infrastructure. The database is hosted by Supabase (Postgres) in an EU region, with daily encrypted backups. The app and API are hosted on Render with TLS-terminated edge servers. We picked these providers specifically because they handle the heavy compliance lifting (encryption, patch management, physical security) and let us focus on the app.

02Encryption — in transit and at rest

In transit. Every connection between your device and WealthR is encrypted with TLS 1.3 (or TLS 1.2 fallback for older browsers). HTTP requests are 301-redirected to HTTPS. We send the Strict-Transport-Security header so your browser remembers to only ever talk to us over HTTPS.

At rest. All database storage is encrypted with AES-256, with keys managed by the cloud provider (rotated automatically). Backups inherit the same encryption. If a disk is ever decommissioned, the data on it is unreadable without the keys — which we don't share.

Passwords. Passwords are never stored in plaintext. They're hashed with bcrypt before they hit the database — meaning even we can't read them. If you forget your password we can only send you a reset link, never tell you what it was.

03How sign-in works

Authentication is handled by Supabase Auth — the same library used by thousands of production fintech and SaaS apps. When you sign in we issue a short-lived JWT (JSON Web Token) that your browser uses to identify itself to the API. Tokens auto-rotate; if one leaks, it's invalid within minutes.

• Email + password with bcrypt hashing
• Password reset via signed time-limited email link
• Session tokens stored in HttpOnly cookies where supported, never in localStorage for auth purposes
• Rate limiting on sign-in and reset endpoints to slow brute-force attempts

04Why we don't link to your bank

Most UK finance apps connect via Open Banking — which means a third-party aggregator (Plaid, TrueLayer, Yapily) holds a long-lived token that lets them read your transactions. That token is a target. If the aggregator is breached, every connected app is breached.

WealthR is manual entry. You type your totals once a month. We never ask for, see, or store your bank credentials, sort code, account number, or transaction history. The blast radius of a WealthR breach is therefore limited to the figures you chose to share — not your real-time spending or account access.

This is a deliberate trade-off: it costs you 90 seconds a month of typing in exchange for materially less attack surface than any aggregator-based competitor.

05Application security

• Row-level security (RLS) enforced at the database layer — every query is scoped to the signed-in user's ID. A bug in the app can't expose another user's data because the database itself refuses.
• Content Security Policy (CSP) headers on every page to mitigate XSS and clickjacking.
• Input validation on every API endpoint with strict schemas — no free-text SQL anywhere.
• Dependency monitoring via automated GitHub Dependabot alerts. Critical CVEs are patched within 48 hours.
• Secret management — API keys and secrets live in the platform's encrypted environment variables, never in source code.
• Audit trail & version history — every change to your records is captured with who made it, when, and what changed. A full version history is retained, so any previous state can be recovered — and the trail is kept for 7 years for record-keeping.

ADVAdviser Workspace & client portals

When a financial adviser or firm uses WealthR to manage their clients, the same foundations above apply — plus protections specific to handling client data on a firm's behalf:

• Per-firm isolation. Every firm's clients are separated at the database layer by row-level security, so one firm can never see another's data, and a colleague only sees the clients they're permitted to.
• PIN-protected portals. Each client portal link requires a numeric PIN that isn't derived from the client's data and is shared separately from the link. After repeated wrong attempts the portal locks for a cooldown period — blocking guessing, even of a forwarded or intercepted link.
• Private document vault. Documents live in a private store that is never publicly reachable. Uploads and downloads happen only through short-lived signed links (download links expire within two minutes), and every request is access-checked before anything is served. Files can be set to auto-delete on a retention schedule, and every removal — manual or automatic — is recorded in an audit trail.
• Per-firm storage limits. Each firm has a storage allowance, preventing any one firm from exhausting shared capacity.
• Full audit trail & recoverable history. Every change an adviser makes to a client's records is recorded — who made it, when, and what changed — and a complete version history is retained for 7 years, so any earlier state can be reproduced and reviewed. Together with daily encrypted backups and point-in-time recovery, a firm can always evidence exactly what a client's plan looked like on any given date.
• Branded emails carry no figures. Emails to a firm's clients contain only a name, a short message and a secure link — never financial values — with anti-spam safeguards and sending limits, and clients can opt out of notifications while still using the portal.
• Invite-only access. Joining a firm's workspace is by invitation from the firm's administrator; the branded sign-in does not allow open self-registration.

Where WealthR processes client data for a firm it does so as the firm's data processor, under a separate Data Processing Agreement. See our Privacy Policy for the controller/processor split.

06Backups and recovery

The database is backed up automatically every day, with point-in-time recovery so we can roll back to a precise moment if something goes wrong. Backups are encrypted and stored separately from the live database. If a disaster takes out the primary, we can restore to a working state within hours, not days.

Separately, WealthR keeps a full version history of every change to your records, retained for 7 years — so any earlier state can be recovered, and there is a complete, time-stamped record of what changed and when.

You can also export your own data at any time from the app — see Settings → Export data. We give you a clean JSON file containing every figure you've ever entered. Your data is yours; we won't hold it hostage.

07Responsible disclosure

08What we ask of you

Security is a shared responsibility. The single biggest determinant of your account safety is your own password hygiene.

• Use a unique password. A password manager (1Password, Bitwarden, Apple Passwords) makes this effortless.
• Don't reuse passwords from breached sites. Check haveibeenpwned.com if unsure.
• Keep your devices and browsers up to date — most real-world account takeovers happen via outdated software, not server breaches.
• Be cautious of phishing. WealthR will never ask for your password by email. Sign-in is always at https://wealthr.co.uk.

09GDPR and your rights

WealthR is a UK GDPR data controller. You have full rights under the UK GDPR including access, rectification, erasure (right to be forgotten), portability, and objection. The full breakdown — including how to exercise each right — is on our privacy policy.

To delete your account and all associated data, go to Settings → Account → Delete account, or email [email protected]. Deletions are permanent and processed within 30 days (UK GDPR-compliant); usually faster.

10Things we will never do

• Sell, share or rent your data to advertisers, brokers or anyone else. Ever.
• Ask for your bank login, card PIN, or one-time codes by email.
• Run third-party tracking pixels or ad networks on the app.
• Use your financial data to train AI models.
• Make changes to your account on your behalf without explicit consent.

11Get in touch

For security reports use the dedicated address. For general queries the support inbox is fine — both go to the same person.

This page is informational and reflects our current implementation. It is not a contract; the legally binding documents are our terms and privacy policy. We update this page whenever the underlying practices change — last updated 1 July 2026.