Security

• In transit: all traffic is served over HTTPS (TLS 1.2+). The site is not reachable over plain HTTP.
• At rest: the database lives on encrypted storage. AWS documents that the block storage we use, and its snapshots, are encrypted at rest by default with AWS-managed keys.
• At rest, second layer: the most sensitive fields, being Open Banking and HMRC access and refresh tokens, two-factor secrets, and the original documents you upload, carry a further layer of AES-256-GCM encryption applied before they are written. That key is held in the server environment, never in the database alongside the data it protects. Other columns, such as transaction descriptions and balances, rely on the storage encryption above rather than a second layer.

• Passwords are never stored. We keep only a one-way hash, computed with PBKDF2-HMAC-SHA256 at 200,000 iterations with a unique per-account random salt.
• Two-factor authentication (TOTP) is available to every account from Settings → Security — a one-time code from an authenticator app (Google Authenticator, 1Password, Authy…) on top of your password. We strongly recommend enabling it, and prompt you until you do.
• Password checks use a constant-time comparison, so the server's response time can't be used to guess your password.
• Password resets use a single-use link that is itself stored only as a SHA-256 hash, expires after one hour, and invalidates every existing session when used.

Bank connections are made through TrueLayer, an FCA-authorised Account Information Service Provider. You authenticate directly with your own bank; your banking credentials are entered on your bank's site and are never seen, handled, or stored by Wealth Camera.

The access is read-only — we can see balances and transactions to build your picture, and we cannot move money. You can revoke a connection at any time from the Balance sheet page, which deletes the stored tokens immediately and asks the provider to revoke the consent.

Where you choose to connect HMRC, authentication is handled entirely by HMRC's own Government Gateway OAuth. We never receive or store your Government Gateway username or password, we request read-only access only, and the access is revocable at any time from your HMRC account or from Settings.

• Account registration is closed during the private beta.
• Repeated failed logins and password-reset requests are rate-limited to slow online guessing.
• Uploads are size-capped and validated before processing.
• Inputs that flow into exports or external lookups are sanitised (e.g. CSV formula-injection escaping, strict postcode validation).
• Cross-origin access is restricted to our own front-end origins; the API is otherwise same-origin.

The database is backed up every night. Backups are encrypted with a key that is separate from the application's own, copied off the server, and we test that they actually restore rather than assuming it. The last restore test was 13 August 2026 and it passed, both on the server and independently from the off-site copy.

Wealth Camera is an early-stage private pilot, not a regulated deposit-taker or custodian — we never hold your money or assets, only a read-only picture of them. We are not yet independently security-certified (e.g. ISO 27001 / SOC 2), and we have not yet commissioned an independent penetration test; both are planned before we open to the public. We run on a single server, so recovery from a serious failure means restoring from backup rather than failing over. We believe in saying what we do and don't have, rather than implying assurances we haven't earned.

If you believe you've found a security issue, please email security@wealthcamera.com. We welcome responsible disclosure and will respond promptly.