How Wealthcast protects your data

In short

• You choose where your plan is stored: in our EU-jurisdiction cloud storage, or encrypted on your own device.
• Your data is encrypted in transit, and stored plans are encrypted at rest in both storage modes.
• You sign in with Google, Apple, an emailed magic link or a passkey. We recommend adding a passkey.
• Optional AI features are off until you turn them on, and send only the data they need.
• We do not sell your plan data, and we do not store card numbers. Checkout runs on Stripe.
• Found a weakness? See Reporting a vulnerability.

Security principles

We design Wealthcast around four principles:

• Least data, by default. We collect only what is needed to run your plan and keep your account secure. Foresight, AI import and other optional features are off by default.
• Your storage choice, your trust boundary. Before you enter any financial data we ask whether you want EU-jurisdiction cloud storage or this-device encrypted storage in the same Wealthcast app. The choice you make defines who can read your plan.
• Keep stored local-mode plan data encrypted. The local plan bundle and backups exported from local mode are encrypted, not flat JSON. Optional features such as Foresight send selected plan data for server-side processing only after you consent.
• Be open about limits. We say what each storage mode does and does not protect against, and accept reports from anyone who finds a weakness.

Two storage modes

After accepting our terms, every signed-in account chooses one of two storage modes before entering financial data. You can switch later; switching back to cloud mode requires the local browser to still hold the encrypted bundle, so a stale device cannot wipe your cloud plan.

• Cloud mode stores your plan in our EU-jurisdiction databases. Your data syncs across browsers and devices when you sign in. This is the default.
• Encrypted local mode keeps your plan on the device you use. You can still export an encrypted file backup, and you can optionally save an Encrypted cloud backup that is locked with a password in your browser before it is uploaded. Wealthcast cannot unlock or reset that password.

Cloud mode

Cloud-mode plans are stored in Cloudflare D1 databases in Cloudflare’s EU jurisdiction. Files you upload, such as bug-report screenshots, are stored in Cloudflare R2, also in the EU jurisdiction.

• Data is encrypted at rest by Cloudflare and encrypted in transit over TLS.
• Application data access is scoped to the signed-in user.
• Secrets such as session signing keys are held in a managed secrets store, not in code, and can be rotated.
• We do not sell cloud-mode plan data. Hosting providers and optional services process data as described in the Privacy Notice.

EU residency on Cloudflare D1 and R2 is a storage-residency posture. It is not a claim that every byte of request processing or operational metadata is processed only in the EU. Edge requests are still served globally, and Cloudflare-managed metadata may transit other regions. Encrypted local mode keeps your saved plan bundle on your device. Optional online features can still send selected plan data through Wealthcast for processing, as described in the Privacy Notice.

Encrypted local mode

Local mode encrypts the plan saved in your browser and exported backup files. Reading one of those copies requires the account’s data key, which Wealthcast supplies after authenticating the account.

How a plan is encrypted

• When you first use local mode, our server generates a random 256-bit data key.
• The data key is wrapped (encrypted) on our server using a separate server-side secret, then stored against your account. The unwrapped key is never written to disk on our side.
• Your plan, scenarios and snapshots are encrypted with AES-GCM 256 using that data key and stored as an encrypted browser bundle. The plaintext bundle exists only in memory while the page is open.
• Backup files exported from local mode are written in the same encrypted envelope. There is no plaintext export option.

Encrypted cloud backups are different from Cloud storage. The backup is encrypted in your browser with the password you choose before it reaches Wealthcast. We store the locked backup file and basic metadata only. If you forget the password and no old browser or exported file can still unlock the plan, the encrypted cloud backup cannot be recovered.

How the key is unlocked

On every fresh page load, the signed-in browser asks Wealthcast to unlock its data key. The server unwraps the key for the authenticated user and returns it over TLS; the browser keeps it in memory only, decrypts the encrypted bundle, and re-encrypts on every save. The key is bound to your account rather than a particular device, but the encrypted plan bundle remains in the browser where you saved it.

What this gives you

• Stolen browser storage alone is not enough to read your plan: an attacker also needs your authenticated session against our server.
• Stolen backup files alone are not enough to read your plan: backups are ciphertext-only.
• Backup imports are bound to the signed-in Wealthcast account. A backup from another account is rejected.
• A copy of our server-side key records alone is not enough to read your plan: the encrypted plan bundle is stored in your browser, and key material is not stored unwrapped on our side.

What it does not give you

• Local mode is not multi-device and there is no automatic sync. If you lose the device, the plan is gone unless you exported an encrypted backup file or saved an Encrypted cloud backup and still know its password.
• Local mode still requires a Wealthcast account so we can wrap and unwrap your data key. Fully account-less use is not supported.
• A determined attacker who fully controls your signed-in browser (malicious extension, full XSS, compromised device) can observe the plaintext while the page is open. No web app can prevent that; the point of local mode is that everything outside that one browser session stays encrypted.

What we protect against

These are the risks we design Wealthcast around, and what each storage mode does about them. “Protected” means the attacker cannot read your plan. “Reduced” means we limit the impact but cannot fully prevent it. “Outside our control” means no realistic web app can prevent it.

Someone watching your network traffic

Protected in both modes. All traffic uses TLS, including the local-mode key unlock.

A stolen device that is signed out

Protected in local mode: the saved plan is encrypted and the key cannot be fetched without signing in. Reduced in cloud mode: sessions expire and can be revoked.

A stolen backup file

Protected in local mode: the file is encrypted. Cloud mode does not export full plan files in the same way; database access is gated by account sign-in.

A breach of Wealthcast’s servers

Cloud mode: reduced. Plan data could be read by an attacker who fully compromises both database and application. We reduce the risk with secret rotation, scoped database access, audit logging and isolated infrastructure.

Local mode limits what a database-only breach reveals because your encrypted plan bundle is stored in your browser. It does not protect against full control of the service: a compromised server could serve altered code or interfere with key delivery to capture decrypted plan data when you use the app. Optional online features also process the plan data needed for their requests.

A malicious browser extension or compromised device

Outside our control in either mode. Code that runs inside your browser tab can already see whatever the application can see. Use a clean profile or a dedicated browser if this matters to you.

Phishing

Reduced. Passkeys are origin-bound and cannot be phished by a look-alike domain. Magic links and Google/Apple sign-in pin to Wealthcast. We recommend enrolling at least one passkey.

Payment details

Wealthcast does not store card numbers; checkout runs on Stripe.

Account security

• We support Google sign-in, Sign in with Apple, Wealthcast magic links and WebAuthn passkeys. They all converge on one Wealthcast account and one signed session model.
• Sessions are signed with a server-side secret that can be rotated.
• Sign-in attempts are bound to the browser that started them, and passkey checks use a short-lived challenge.

Network and transport

• Wealthcast is served via Cloudflare with TLS terminated at the edge and HSTS enabled.
• Browser security headers and an enforced Content Security Policy are set on every response.
• Rate limits and request size limits protect against abuse.
• We monitor availability from outside our network and publish results at status.wealthcast.app.

Application hardening

• Destructive actions such as account reset require a signed-in session and are protected against cross-site requests.
• Uploaded screenshots and AI-import files are size-limited and treated as untrusted content.
• Optional AI features minimise what they send. Foresight uses derived plan context and removes the personal identifiers we can detect; AI import processes only the content the user chooses to provide. The Privacy Notice explains the processors and retained data.
• Subscription changes are validated against the signed-in account.
• Paid checkout is account-level, so encrypted-local users can subscribe without moving plan data into cloud storage.
• Account deletion removes or redacts Wealthcast account links, billing email, personal billing links and raw webhook payloads. Limited billing and audit records, including necessary Stripe reference IDs, may remain for reconciliation, security, disputes or legal duties.

Security reviews

We review sensitive areas of Wealthcast, including sign-in, sessions, payments, Connected AI and data access, when they change materially. These reviews are not a third-party security certification, and a review is not a promise that the service has no vulnerabilities.

Wealthcast Ltd is Cyber Essentials certified.

Reporting a vulnerability

If you believe you have found a security weakness in Wealthcast, email security@wealthcast.app with a description and the steps you already took. Do not include another person’s data or publish details that would expose accounts while the report is being assessed.

This reporting channel does not authorise testing, probing or access to other people’s data. The obligations in clause 5 of our Terms of Service still apply. Contact us to agree a scope in writing before carrying out security testing.

We do not currently run a paid bug bounty programme. Any public credit for a report will be agreed with the person who submitted it.