Security

• In transit: all traffic is served over HTTPS (TLS 1.2+). The site is not reachable over plain HTTP.
• At rest: sensitive fields — Open Banking access and refresh tokens, and the original documents you upload — are encrypted with AES-256-GCM before they are written to storage. The encryption key is held in the server environment, never in the database alongside the data it protects.

• Passwords are never stored. We keep only a one-way hash, computed with PBKDF2-HMAC-SHA256 at 200,000 iterations with a unique per-account random salt.
• Two-factor authentication (TOTP) is available to every account from Settings → Security — a one-time code from an authenticator app (Google Authenticator, 1Password, Authy…) on top of your password. We strongly recommend enabling it, and prompt you until you do.
• Password checks use a constant-time comparison, so the server's response time can't be used to guess your password.
• Password resets use a single-use link that is itself stored only as a SHA-256 hash, expires after one hour, and invalidates every existing session when used.

Bank connections are made through TrueLayer, an FCA-authorised Account Information Service Provider. You authenticate directly with your own bank; your banking credentials are entered on your bank's site and are never seen, handled, or stored by Wealth Camera.

The access is read-only — we can see balances and transactions to build your picture, and we cannot move money. You can revoke a connection at any time from Settings, which deletes the stored tokens immediately.

Where you choose to connect HMRC, authentication is handled entirely by HMRC's own Government Gateway OAuth. We never receive or store your Government Gateway username or password, we request read-only access only, and the access is revocable at any time from your HMRC account or from Settings.

• Account registration is closed during the private beta.
• Repeated failed logins and password-reset requests are rate-limited to slow online guessing.
• Uploads are size-capped and validated before processing.
• Inputs that flow into exports or external lookups are sanitised (e.g. CSV formula-injection escaping, strict postcode validation).
• Cross-origin access is restricted to our own front-end origins; the API is otherwise same-origin.

Wealth Camera is an early-stage private pilot, not a regulated deposit-taker or custodian — we never hold your money or assets, only a read-only picture of them. We are not yet independently security-certified (e.g. ISO 27001 / SOC 2). We believe in saying what we do and don't have, rather than implying assurances we haven't earned.

If you believe you've found a security issue, please email security@wealthcamera.com. We welcome responsible disclosure and will respond promptly.