Security
Built to be trusted with your money data.
You are trusting us with statements from your banks. This page explains, in plain terms, how we handle them.
How we protect your data
Upload-only
You upload statements you download yourself. We never ask for online-banking or broker passwords, and inWst cannot move money.
Your data is separated in the database
Every account's records are isolated by row-level security in the database itself. A query for one account cannot return another account's rows, even if application code had a bug.
Encrypted in transit
All traffic to inwst.com, the app and the API uses HTTPS. Browsers are told to use HTTPS only (HSTS).
No third-party trackers or cookies
No advertising or third-party analytics, no third-party fonts, no cookies. The Money Health Check sends anonymous usage counts to our own API, never amounts or your answers. The only outside request the website makes is to our own API.
Minimal data
We collect only what a feature needs. For the waitlist that is your email address. IP addresses are never stored as such: for abuse prevention only as a salted hash, and to tell visits apart only inside a code that changes every day.
Tested, reversible releases
Every change runs through automated tests before release. The database is backed up before every schema change, and each release can be rolled back.
Your control
You decide which files go in, and you can ask us to delete your data at any time. Our privacy promise explains what we store and never do in plain language; the privacy policy has the legal detail.
Report a security issue
If you find a vulnerability, email [email protected] with the subject “Security report”. Please give us reasonable time to fix it before you share details. Our security.txt lists the same contact.