Security

We design Welthr with a privacy-conscious, least-privilege mindset suitable for personal financial tracking.

The statements below describe the current application architecture — not certifications we hold unless explicitly stated.

Sign-in uses credential-based authentication via NextAuth with JWT sessions.

Passwords are stored using bcrypt hashing — we do not store plaintext passwords.

Each user's portfolio is tied to their account. API routes enforce ownership checks before returning or modifying assets and transactions.

Use HTTPS in production (configure TLS at your reverse proxy or hosting provider).

Database credentials and secrets should be stored in environment variables, not in source control.

We do not claim SOC 2, ISO 27001, or PCI compliance unless you implement and certify those separately.

Email-based password reset depends on SMTP configuration; links are time-limited tokens stored as hashes.

If you discover a security issue, please use Report Issue or email us responsibly. Do not publicly disclose vulnerabilities before we have had a chance to respond.