WealthY Security Whitepaper

Customer-facing summary of every security control WealthY implements. This document is what you send prospects who ask "what's your security posture?" before SOC 2 Type 1 is in hand.

Version: 1.0 Last updated: 2026-10-10 Contact: sales@wealthy.to

Executive summary

1001536620 Ontario Corp., carrying on business as WealthY, builds an AI-native wealth-management platform for Canadian dealers, firms, advisors, and their clients. We handle regulated personal financial data and design our controls to a Canadian regulatory standard: PIPEDA for privacy, CIRO NI 31-103 for record-keeping and supervision, PCMLTFA for AML posture, and CASL for electronic communications.

Our data infrastructure is hosted in Canada (Supabase project in ca-central-1), and every layer of the platform enforces cryptographically-enforced tenant isolation (Postgres Row-Level Security) so that no firm can ever see another firm's data.

A SOC 2 Type 1 audit is planned and has not started; no report exists yet. We maintain the underlying controls today. This whitepaper describes what those controls are, so procurement teams can validate our posture directly.

1. Data protection

1.1 Encryption at rest

• Database: Supabase-managed Postgres with AES-256 encryption at rest on AWS-provided disks.
• Object storage: Supabase Storage (documents, attachments, custodian files) --- AES-256 encrypted at rest.
• Field-level encryption: Sensitive fields WealthY holds directly (OAuth refresh tokens, SFTP passwords + private keys, custodian credentials) are additionally encrypted with AES-256-GCM at the application layer using a key stored only in Vercel environment variables. See lib/security/field-crypto.ts in our source repository.

1.2 Encryption in transit

• TLS 1.2 or higher on every public endpoint. HSTS enabled with max-age=63072000; includeSubDomains; preload.
• Content Security Policy headers on every response restrict the origins that can load our JavaScript, connect via WebSocket, or embed our content.

1.3 Data residency

• Primary Postgres database + Object storage: AWS Canada Central (ca-central-1, Montreal-adjacent).
• Serverless functions (the API): Vercel yul1 (Montreal). The static web app is served from Vercel's global edge network.
• Some features send data to sub-processors outside Canada: AI reading, drafting and transcription, meeting recording, e-signature, phone calls and transactional email. Text is redacted before it reaches an AI provider; scanned documents, photos, flat forms with the client's details, and audio are sent whole, without redaction. The sub-processor list shows what each provider receives and where it runs. This is region pinning for compute and data at rest, not a guarantee that data never leaves Canada.

2. Tenant isolation

WealthY hosts every firm on the same Postgres cluster but strictly isolates their data via Postgres Row-Level Security. Every table containing customer data has an RLS policy that scopes every SELECT, INSERT, UPDATE, and DELETE to the current user's role and firm.

Six roles are defined: - super_admin --- WealthY employees only (used for support and incident response) - dealer_admin --- Sees firms under one dealer - firm_admin --- Sees one firm - firm_support_admin --- Sees one firm scoped to specific advisors - advisor --- Sees their own book of clients - client --- Sees their own accounts

RLS is enforced at the database layer. Even if application code were compromised, no query originating outside super_admin context could see cross-firm data.

We have a cross-tenant RLS audit script that runs regularly and verifies no policy grants cross-firm reads. Our source repository contains the specific test cases at scripts/audit-rls.ts.

3. Authentication + access

3.1 User authentication

• Users authenticate via Supabase Auth (bcrypt password hashing) with email and password, or with Google or Microsoft sign-in. SAML single sign-on is not offered today.
• An open WealthY tab signs the user out after 30 minutes without activity, with a 60-second warning. On the server, a nightly job is built to end any session older than 29 days or unused for more than an hour; enforcement is a configuration switch, and until it is on the job only reports what it would end. An access token already issued stays valid until it expires (one hour by default).
• Multi-factor authentication (an authenticator app, TOTP) is available to every user on every plan. A firm owner can require it for the firm's advisors, firm owners, admin support and sales seats.

3.2 Employee access

• Least privilege by default. New employees start with no production access; each grant is documented. A dated access review is not yet on file.
• MFA required on every WealthY employee account that touches production infrastructure (Supabase, Vercel, GitHub, DNS, Google Workspace).
• Documented onboarding and offboarding --- every access grant is logged; every departure follows a 24-hour credential rotation procedure.

3.3 Support-admin impersonation

When a firm support admin enters an advisor's workspace to help with a support ticket, WealthY: - Records the impersonation in admin_audit_log with actor + subject. - Displays a persistent banner in the UI so nobody forgets they're operating on another user's account. - Continues to log every mutation with last_touched_by = <admin id>.

4. Compliance controls

4.1 PIPEDA

• Data-subject rights (access, correction, deletion) supported per §7 of our internal Data Classification Policy.
• Breach notification within 72 hours of confirmation, per PIPEDA §10.1, when the breach creates real risk of significant harm.
• Data-processing agreements available on request.

4.2 CIRO NI 31-103

• KYC records: Stored in client_kyc with 36-month review cadence tracked automatically. Advisor sees a color-coded chip indicating currency; firm-admin CIRO PDF report surfaces overdue records.
• Supervision activity: Every admin action logged in admin_audit_log --- evidence of s.11.1 supervision.
• 7-year record retention: Message archive integration with Global Relay + Smarsh (customer-provided credentials) exceeds s.11.5.

4.3 PCMLTFA / FINTRAC

• Client AML risk rating recorded in client_kyc.aml_risk_rating.
• PEP screening outcome tracked in client_kyc.aml_pep_screening_status.
• Annual review cadence enforced with age-of-review indicator on the advisor's client-detail view.
• CIRO PDF report surfaces AML posture at firm level.
• Auto PEP screening via paid data provider (Refinitiv / Dow Jones) is a customer-optional add-on if required.

4.4 CASL

• Consent state (express, implied, none) tracked on both clients and prospects.
• Every broadcast enforces consent + unsubscribe headers per s.6(2)(c).
• RFC 8058 one-click unsubscribe in every message; Gmail and Outlook surface their native "Unsubscribe" button.
• Broadcast history logged in broadcasts for audit.

5. Vulnerability management

• Dependabot monitors every npm and GitHub Actions dependency weekly and opens PRs for security patches.
• Manual npm audit runs on every deploy attempt.
• OWASP-style static audit script covers common web-app misconfigurations.
• Penetration test: No external penetration test has been performed yet. One is planned alongside the SOC 2 audit, and its summary will be shared with customers when it exists.

6. Change management

• Every code change ships as a Git commit under Conventional Commits.
• Migrations are numbered, versioned, and reviewed before deploy.
• Every schema change includes a rollback plan.
• Emergency changes are allowed for Sev-1 incident response but must be documented within 24 hours per our Change Management Policy.

7. Availability + business continuity

• Availability target: 99.9% monthly. This is a target, not yet a measured or contractual figure.
• Recovery targets: restore within 4 hours, and lose at most 24 hours of data.
• Backups: the database provider takes daily automated backups in Canada. Point-in-time recovery is not enabled yet.
• Backup testing: no restore drill has been run yet. The first is planned and its result will be recorded here.
• Vendor reliance: Supabase (Pro plan) and Vercel (Pro plan), under their published service terms.

8. Third-party vendors

WealthY relies on a set of sub-processors. Each publishes its own security attestations and data processing terms, which we rely on today; no executed data processing agreement or vendor security report is on file yet. The main ones:

• Supabase: database, sign-in and file storage (ca-central-1, Montreal)
• Vercel: application hosting (functions in Montreal)
• Google: Gemini API for AI reading, drafting and transcription; Gmail, Calendar and Google sign-in
• Anthropic: Claude API, the default model for meeting briefs and email drafts
• OpenAI: Whisper transcription of recorded calls; GPT as the last fallback
• Microsoft: Outlook, calendar, Teams and Microsoft sign-in
• Recall.ai: meeting recording (AWS us-east-1)
• Documenso Inc.: e-signature (United States)
• Resend: transactional email
• Twilio: voice calling and call recordings
• Stripe: firm billing
• Unipile: LinkedIn connection for outreach (prospecting data, no client records)
• BridgeFT: US custodian data feed

The full list, with what each vendor receives, where it is processed and the integrations a firm connects itself, is on the sub-processor page. 30-day notice on any change.

9. Incident response

We maintain a written Incident Response Plan defining severity levels, declaration triggers, containment procedures, and notification obligations. Key commitments to customers:

• Security reports from outside WealthY: acknowledged within 3 business days, the same commitment as our security.txt and vulnerability disclosure policy.
• Breach notification: within 72 hours of confirmation.
• Post-incident report: within 5 business days.
• Regulator notification: as required (Privacy Commissioner, CIRO via firm, provincial commissions).

10. Certifications + attestations

Contact

• Security incidents: sales@wealthy.to, read by the founder. Reports are acknowledged within 3 business days.
• General security questions: sales@wealthy.to
• DPA / procurement: sales@wealthy.to
• Vulnerability disclosure: sales@wealthy.to --- we honor a 90-day disclosure timeline for responsibly-reported issues.

This whitepaper is provided for informational purposes and does not constitute a contractual commitment. Specific commitments are captured in your Master Services Agreement and Data Processing Agreement.

This whitepaper is provided for informational purposes and does not constitute a contractual commitment. Specific commitments are captured in your Master Services Agreement and Data Processing Agreement. View the current sub-processor list at /legal/sub-processors.html.