Security

• In transit: all traffic is served over HTTPS (TLS 1.2+). The site is not reachable over plain HTTP.
• At rest: the database lives on encrypted storage. AWS documents that the block storage we use, and its snapshots, are encrypted at rest by default with AWS-managed keys.
• At rest, second layer: the most sensitive fields, being Open Banking and HMRC access and refresh tokens, two-factor secrets, and the original documents you upload, carry a further layer of AES-256-GCM encryption applied before they are written. That key is held in the server environment, never in the database alongside the data it protects. Other columns, such as transaction descriptions and balances, rely on the storage encryption above rather than a second layer.

• Passwords are never stored. We keep only a one-way hash, computed with PBKDF2-HMAC-SHA256 at 200,000 iterations with a unique per-account random salt.
• Two-factor authentication (TOTP) is available to every account from Settings → Security — a one-time code from an authenticator app (Google Authenticator, 1Password, Authy…) on top of your password. We strongly recommend enabling it, and prompt you until you do.
• Password checks use a constant-time comparison, so the server's response time can't be used to guess your password.
• Password resets use a single-use link that is itself stored only as a SHA-256 hash, expires after one hour, and invalidates every existing session when used.

Account connections are made through Moneyhub, an FCA-authorised Account Information Service Provider under whose agent permissions we operate (FCA reference number 1062106). Wealth Camera never sees, handles or stores a login for any of your accounts under either method. What differs is where you type it and who holds it.

Open Banking API (banks, cards, and a few investment and pension providers). You log in on your bank's own site or app and choose the accounts to share. Nobody but your bank ever handles your credentials. Moneyhub receives a revocable, read-only token that expires after 90 days.

Screen-scraping (most investment platforms and pension providers, such as Hargreaves Lansdown, AJ Bell, Vanguard and Interactive Investor). These providers have no Open Banking API yet, so you enter your platform username and password on a page hosted by Moneyhub, and Moneyhub logs in as you to read balances and holdings, usually asking you for a one-time code on each refresh. Moneyhub holds those credentials encrypted under its own security controls so it can refresh the connection; they never pass through Wealth Camera. Because this relies on the platform's website, it can break when the platform changes, and some platforms' terms discourage sharing login details with third parties. Moneyhub's provider list shows which method applies before you connect, so you can choose to upload a statement instead.

Under both methods the access is read-only — we can see balances, holdings and transactions to build your picture, and nothing can move money. You can revoke a connection at any time from the Balance sheet page, which deletes the stored tokens immediately and asks Moneyhub to revoke the consent and, for screen-scraping connections, delete the stored credentials.

Where you choose to connect HMRC, authentication is handled entirely by HMRC's own Government Gateway OAuth. We never receive or store your Government Gateway username or password, we request read-only access only, and the access is revocable at any time from your HMRC account or from Settings.

• Sign-ups are rate-limited per connection and every registration is written to the audit log; passwords must meet the policy in section 2 from the first day.
• Repeated failed logins and password-reset requests are rate-limited to slow online guessing.
• Uploads are size-capped and validated before processing.
• Inputs that flow into exports or external lookups are sanitised (e.g. CSV formula-injection escaping, strict postcode validation).
• Cross-origin access is restricted to our own front-end origins; the API is otherwise same-origin.

The database is backed up every night. Backups are encrypted with a key that is separate from the application's own, copied off the server, and we test that they actually restore rather than assuming it. The last restore test was 13 August 2026 and it passed, both on the server and independently from the off-site copy.

Wealth Camera is an early-stage pilot, not a regulated deposit-taker or custodian — we never hold your money or assets, only a read-only picture of them. We are not yet independently security-certified (e.g. ISO 27001 / SOC 2), and an independent penetration test has not yet been completed: one is being arranged against a staging copy of the service, and we opened self-serve sign-up during the pilot before it was done rather than imply otherwise. We run on a single server, so recovery from a serious failure means restoring from backup rather than failing over. We believe in saying what we do and don't have, rather than implying assurances we haven't earned.

If you believe you've found a security issue, please email security@wealthcamera.com. We welcome responsible disclosure and will respond promptly.