Security Policy

Last updated: 10 June 2026

Security is foundational to Wealth Locker. The financial, insurance, and estate information you store with us is among the most sensitive data you own, and we treat its protection accordingly. This section describes the technical and organisational measures we use to protect your information — written plainly, and kept honest about what we do and don't do.

In transit

• All traffic is encrypted with HTTPS/TLS
• HTTPS is enforced (HSTS), so browsers always use a secure connection
• API communication between your browser and our servers is encrypted end to end

At rest

• Your database records are encrypted at rest
• Uploaded documents are held in storage with server-side encryption

Passwords

• Authentication is handled by our auth provider (Supabase Auth)
• Passwords are stored only as salted hashes — never in plaintext
• Password-reset links are time-limited and single-use

Sign-in

• Secure email-and-password authentication
• Sessions use short-lived tokens that expire automatically and are invalidated on logout
• Our auth provider applies brute-force protection on repeated failed attempts

Database access rules

Access control is enforced at the database itself, not just in the application:

• Every query is checked against the signed-in account's access rules
• Each account can only read the rows it is allowed to see, even at the database level
• An adviser can reach a client's data only where an explicit, recorded access link exists, or through the firm access described in the Privacy Policy

Least privilege

• Our administrators' access to customer data is limited to administrator accounts and enforced by the database's access rules
• Service credentials that bypass RLS are never exposed to the browser
• Internal service-to-service calls are protected with a shared secret
• Third-party integrations are granted only the access they need

Cloud infrastructure

• Database, authentication, and storage run on Supabase
• The application is hosted on Netlify

Network protection

• Provider-level network protection and DDoS mitigation

Application security

• Security headers, including a Content Security Policy
• Input validation and protection against common web vulnerabilities (OWASP Top 10)
• Regular dependency updates and vulnerability patching

Secure development

Every change goes through an automated pipeline before it ships, which includes:

• Type-checking and an automated test suite
• Dependency vulnerability auditing and review
• Static application security testing (SAST) and secret scanning
• Code review before changes are merged

Monitoring

• A record of account activity: changes to records, changes made through our admin tools, and changes to adviser and firm access
• Errors in the application are recorded

If something goes wrong

We maintain a documented incident-response process:

1. Detect & record: identify, classify, and log the incident, preserving evidence
2. Contain: limit the impact, revoke and rotate credentials, and lock down affected access
3. Assess: determine the root cause and which data and individuals are affected
4. Recover: patch the cause, restore safe operation, and verify the fix
5. Notify: where a breach is likely to cause serious harm, we notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme
6. Review: conduct a post-incident review and improve our controls

Security is a partnership. You can help keep your account safe:

Passwords

• Use a unique password you don't use anywhere else
• Use a password manager to generate and store it
• Change it promptly if you think it may have been exposed

Your account

• Never share your login details
• Log out when using a shared or public computer
• Report anything suspicious to us straight away

Your devices

• Keep your device and browser up to date
• Be cautious of phishing messages claiming to be from Wealth Locker
• Only sign in from networks you trust

Our commitments

• Australian Privacy Act: we handle personal information in line with the Australian Privacy Principles
• Recognised standards: we align our practices with established information-security frameworks

Ongoing assurance

• The platform has undergone a dedicated security-hardening and penetration-style review
• Automated security scanning runs on every change
• We patch vulnerabilities and update dependencies on an ongoing basis

Our providers

The providers we rely on, what each one does and where each one handles information are listed in our Data Policy. We do not publish certification claims for them here.

We welcome responsible disclosure. If you believe you've found a security vulnerability, please tell us through the contact form below (choose "Report a security concern") and include:

• A clear description of the issue and its potential impact
• Steps to reproduce it, if you can
• Any affected pages or accounts

Please don't access, modify, or delete data that isn't yours while testing, and don't disclose the issue publicly until we've had a chance to address it. We acknowledge reports and, with your consent, will credit your contribution.