How we protect your data

All traffic runs over TLS. Data and uploaded documents are encrypted at rest by the managed platform.

Every record is scoped to your account with row-level security enforced in the database, not only in the app.

Uploaded files live in a private bucket and are served through short-lived signed links.

We never ask for your pension portal logins. There is nothing for an attacker to steal, because we never hold them.

Passwords are hashed by the managed authentication service; social sign-in is available.

The application and database run on managed cloud infrastructure with automated backups and patching.

Where a national institution exposes an official API to third parties, we intend to use it rather than scraping or storing your credentials.

No such integration is live today.

Multi-factor authentication, rate limiting, audit logging and granular consent management are planned and not yet available.