Security

What we do with your data, in plain terms.

Bank connections

Banks connect through Plaid. You enter your credentials on Plaid's own screen, inside the app. Plaid gives WeVault a read-only access token. We can fetch balances and transactions; we cannot move money, and we never see your bank username or password. You can disconnect a bank at any time from Settings → Banks, which deletes the token on our side.

Access tokens are encrypted at rest with AES-256-GCM. The key lives on the server, outside the web root and outside the database.

One database per workspace

Every workspace gets its own database. Your transactions are not rows in a shared table next to a stranger's; they are in a separate database that only your workspace's requests can open.

Private chat and location

The private room, its photos, videos and voice notes, and every location update are end-to-end encrypted. Each phone creates an X25519 key pair in the device's secure storage (Keychain on iPhone, Keystore on Android). A workspace key is passed between devices in envelopes sealed with X25519 + HKDF-SHA256 + AES-256-GCM, so the server only ever holds public keys and ciphertext. We cannot read the private room, and neither can anyone who takes a copy of our database.

The Team + AI room is different on purpose: the assistant reads it so it can answer questions about your numbers. The app labels the two rooms clearly.

Sign-in

Passwords are hashed with bcrypt. Every sign-in also requires a one-time code sent to your email. Each phone or computer gets its own token, which you can revoke from Settings → Devices.

The AI assistant

To categorize transactions and answer questions, we send transaction descriptions, amounts and your notes to Anthropic's API, which does not train on that data. Private-room messages, vault documents and locations are never sent to any AI provider.

Infrastructure

Servers are in the United States. All traffic uses TLS 1.2+ and HSTS (the .app domain requires it). Daily encrypted backups are kept for 30 days. Access to production is limited to the two founders, by SSH key only.

Reporting a problem

If you find a security issue, email support@wevault.app with "Security" in the subject. We read those first and will reply within two business days. Please give us a reasonable time to fix an issue before disclosing it.