Authenticated access
Production access uses Google sign-in through Clerk. Protected requests require a valid session before the app loads household information.
Security and trust
How WealthScout protects household data.
This page describes controls implemented in WealthScout today, the providers we rely on, and the limits you should understand.
Last reviewed: 17 July 2026
Household-scoped authorisation
The server resolves the active Clerk household and its local WealthScout record. Client-submitted household IDs are not accepted as authority.
Private attachments
Supported receipts and invoices use private Vercel Blob storage. Downloads pass through an authenticated WealthScout route and are returned with private, no-store caching.
Reduced diagnostic data
Production error reporting disables default personal information and removes user details, cookies, request bodies, query strings, and authentication or forwarding headers.
Access
Authentication is only the first check.
WealthScout protects household data at the server boundary, not only by hiding screens in the browser.
- Authenticated app routes are protected through Clerk middleware.
- Server reads and mutations re-derive the active household and confirm membership.
- Production requests are restricted to configured authorised app origins.
- Household members currently have full read and write access; any current member can permanently delete the household.
- Terms acceptance is recorded per authenticated account before onboarding or workspace access.
Storage and transport
Financial records and attachments use managed private infrastructure.
The application is hosted on Vercel, financial records are stored in Neon Postgres, and supported attachments use private Vercel Blob storage.
- Production traffic uses HTTPS/TLS provided through the hosting platform.
- Vercel documents AES-256 encryption for Blob files, and Neon documents AES-256 encryption for inactive database storage.
- Private attachments are not delivered through public Blob URLs.
- Attachment access checks the signed-in household, active module and matching expense before streaming a file.
- File type, size, household quota and storage path are validated before an attachment is accepted.
Monitoring
Operational visibility with deliberate data scrubbing.
WealthScout uses production error monitoring to detect failures while reducing the personal information included in diagnostic events.
- Default personal-information transmission is disabled.
- User identity, cookies, request bodies and query strings are removed from error events.
- Authorization, cookie, forwarding and real-IP headers are removed.
- Console breadcrumbs are not sent and request URLs have query strings removed.
- Raw household financial values should not be deliberately written to application logs.
Control and lifecycle
Export, correction and deletion are product features.
Household members can correct records in the app, generate an on-demand data export, and initiate permanent household deletion.
- AI-ready household exports are generated on demand and returned with private, no-store caching.
- The current AI Export is a download; WealthScout does not upload it to an AI provider or keep a separate exported copy.
- We use infrastructure backups and recovery measures, but backups are not a user archive and do not guarantee recovery of every record or file.
- Permanent deletion removes the Clerk household organisation, live household database records, household email records and stored household attachments.
- Separate sign-in identities and account-level legal acceptance records are not deleted with a household.
- Deleted information may remain temporarily in infrastructure backups, delivered emails and provider logs until their normal retention periods expire.
Providers
Who helps operate WealthScout.
Providers receive only the information reasonably needed for their role. Some processing occurs outside Australia; current privacy and overseas-processing details are maintained in the Privacy Policy.
Read the Privacy Policy| Provider | Purpose |
|---|---|
| Clerk | Authentication, sessions, household membership and invitations |
| Vercel | Application hosting, functions, queues and private file storage |
| Neon | PostgreSQL database hosting |
| Resend | Transactional and lifecycle email delivery |
| Better Stack | Production error and reliability monitoring |
| Geoapify | Address autocomplete when a user chooses address lookup |
Current limits
What we do not claim.
- WealthScout is not a bank, broker or custodian.
- We do not currently claim WealthScout-specific SOC 2 or ISO certification.
- We do not offer a guaranteed uptime or support-response SLA.
- Backups do not guarantee recovery of every record or file.
- Household roles are not granular today; current members have full read and write access.
Report a security concern privately.
Email security@wealthscout.app with a clear description and enough detail to investigate. Do not access, change, retain or disclose other people's information, and do not test WealthScout without written authorisation.
Contact security