# How WealthScout protects household data.

> This page describes controls implemented in WealthScout today, the providers we rely on, and the limits you should understand.

Source: https://wealthscout.app/security. Last reviewed 17 July 2026.

## Controls in place today

- **Authenticated access.** Production access uses Google sign-in through Clerk. Protected requests require a valid session before the app loads household information.
- **Household-scoped authorisation.** The server resolves the active Clerk household and its local WealthScout record. Client-submitted household IDs are not accepted as authority.
- **Private attachments.** Supported receipts and invoices use private Vercel Blob storage. Downloads pass through an authenticated WealthScout route and are returned with private, no-store caching.
- **Reduced diagnostic data.** Production error reporting disables default personal information and removes user details, cookies, request bodies, query strings, and authentication or forwarding headers.

## Authentication is only the first check.

WealthScout protects household data at the server boundary, not only by hiding screens in the browser.

- Authenticated app routes are protected through Clerk middleware.
- Server reads and mutations re-derive the active household and confirm membership.
- Production requests are restricted to configured authorised app origins.
- Household members currently have full read and write access; any current member can permanently delete the household.
- Terms acceptance is recorded per authenticated account before onboarding or workspace access.

## Financial records and attachments use managed private infrastructure.

The application is hosted on Vercel, financial records are stored in Neon Postgres, and supported attachments use private Vercel Blob storage.

- Production traffic uses HTTPS/TLS provided through the hosting platform.
- Vercel documents AES-256 encryption for Blob files, and Neon documents AES-256 encryption for inactive database storage.
- Private attachments are not delivered through public Blob URLs.
- Attachment access checks the signed-in household, active module and matching expense before streaming a file.
- File type, size, household quota and storage path are validated before an attachment is accepted.

- [Vercel Blob security](https://vercel.com/docs/vercel-blob/security)
- [Neon security overview](https://neon.com/docs/security/security-overview)

## Operational visibility with deliberate data scrubbing.

WealthScout uses production error monitoring to detect failures while reducing the personal information included in diagnostic events.

- Default personal-information transmission is disabled.
- User identity, cookies, request bodies and query strings are removed from error events.
- Authorization, cookie, forwarding and real-IP headers are removed.
- Console breadcrumbs are not sent and request URLs have query strings removed.
- Raw household financial values should not be deliberately written to application logs.

## Export, correction and deletion are product features.

Household members can correct records in the app, generate an on-demand data export, and initiate permanent household deletion.

- AI-ready household exports are generated on demand and returned with private, no-store caching.
- The current AI Export is a download; WealthScout does not upload it to an AI provider or keep a separate exported copy.
- We use infrastructure backups and recovery measures, but backups are not a user archive and do not guarantee recovery of every record or file.
- Permanent deletion removes the Clerk household organisation, live household database records, household email records and stored household attachments.
- Separate sign-in identities and account-level legal acceptance records are not deleted with a household.
- Deleted information may remain temporarily in infrastructure backups, delivered emails and provider logs until their normal retention periods expire.

## Providers

Providers receive only the information reasonably needed for their role. Some processing occurs outside Australia; current privacy and overseas-processing details are maintained in the Privacy Policy.

- **Clerk.** Authentication, sessions, household membership and invitations
- **Vercel.** Application hosting, functions, queues and private file storage
- **Neon.** PostgreSQL database hosting
- **Resend.** Transactional and lifecycle email delivery
- **Better Stack.** Production error and reliability monitoring
- **Geoapify.** Address autocomplete when a user chooses address lookup

## What we do not claim

- WealthScout is not a bank, broker or custodian.
- We do not currently claim WealthScout-specific SOC 2 or ISO certification.
- We do not offer a guaranteed uptime or support-response SLA.
- Backups do not guarantee recovery of every record or file.
- Household roles are not granular today; current members have full read and write access.

## Report a security concern privately.

Email security@wealthscout.app with a clear description and enough detail to investigate. Do not access, change, retain or disclose other people's information, and do not test WealthScout without written authorisation.