Trust & Security
How your data is protected
Here’s exactly how your family’s information is kept isolated, traceable, recoverable, and yours — in plain English, with the real mechanism behind each promise. Where something is a commitment we make rather than something the code enforces, we say so. That line is the point.
Isolated to you — enforced by the database, not just the screen
Your household’s data is walled off from every other household. Only you, and the people you’ve granted active access, can reach it.
How it works: Postgres row-level security on every data table. Access resolves through hh_can_view() / hh_can_edit(), so the isolation lives in the database itself — the app can’t accidentally reach across households.
Every value traces to a source you can click
Each figure in your picture shows where it came from — a bank statement, a closing statement, a recorded deed, an appraisal, a K-1 — with a link to that document.
How it works: one provenance ladder (lib/valueSource.ts) stamps every figure with its source kind and a confidence tier, plus a link straight to the document it came from.
The honest boundary: We never invent a source. If a value can’t be traced, it stays honestly blank rather than getting a fabricated origin.
Delete is recoverable — nothing vanishes on a misclick
Removing a document moves it to Trash, where you can restore it — the file itself is kept.
How it works: documents soft-delete (a deleted_at marker); the stored file stays in place and is restorable. One uniform delete gate across every surface.
The honest boundary: Permanent removal happens only later and deliberately, through retention — never a silent auto-wipe.
Leave with 100% of your data — and truly leave
Export your whole picture whenever you like, and if you decide to go, your data goes with you and your account is fully removed.
How it works: one-click export in JSON or Excel with per-document download links (your Data page). Account deletion cascades your household data, recursively purges every stored file, and removes your login last — so a failure never strands you locked out with data behind it.
We minimize the most sensitive data by design — your SSN isn’t kept
We keep as little sensitive personal information as we can. Your Social Security number is not stored.
How it works: tax returns are kept as an SSN-free structured summary — SSNs and account numbers are detected and withheld at extraction, so we keep the types and locations, not the values. The audit log redacts ssn / password / secret / token fields from its snapshots, and the emergency card carries routing information only, never account numbers or an SSN.
Passwordless sign-in, with optional two-factor
You sign in with a magic link sent to your email — there’s no password to steal — and you can add an authenticator-app second factor whenever you want.
How it works: magic-link email sign-in, plus opt-in TOTP two-factor (any authenticator app) you enroll from your security settings.
The honest boundary: Two-factor is your choice — available and easy to turn on, and removable anytime. It is not forced.
Never sold. Never used to train AI
We don’t sell your data, and your documents are never used to train AI models.
How it works: “never sold” is our contractual commitment, stated in our Privacy Policy and backed by the household isolation and encryption-in-transit described here. On the AI side there’s a concrete technical basis: document reading runs on Anthropic’s commercial API, whose inputs and outputs are not used to train models and are deleted within about seven days, and we don’t log document contents.
The honest boundary: We frame “never sold” as a promise we hold ourselves to — supported by isolation and encryption in transit — not as a claim that data exfiltration is technically impossible.
Advisor and firm connections are consent-first and reversible
A firm can help manage your picture only if you say yes, and you can disconnect in one tap.
How it works: a firm reaches you only through an invite you accept; connecting is one explicit tap, and detaching revokes the advisor’s access by provenance. For bank links, your bank login stays inside Plaid’s own screen and never reaches us — we hold only an encrypted token (lib/tokenCrypto.ts), keyed by us and never handed to a third party.
The public demo is read-only at the database layer
Anyone can explore a realistic sample family in the live product, but a demo visitor can’t change anything.
How it works: a three-layer write-lock (restrictive row-level security on every table and on storage, a function-level guard via is_demo_user(), and a credential-change block) — enforced by Postgres, not by the interface.
A complete, tamper-evident audit trail
Every change to your data is recorded — who changed what, and when — and can be reconstructed.
How it works: an activity log captures before/after row snapshots on each change, with sensitive keys (ssn, password, secret, token) redacted from the record.
Backed by hundreds of automated guardrails
The behaviors on this page aren’t just intentions — they’re checked on every release.
How it works: our build fails unless a large suite of deterministic invariant checks passes (scripts/test-scenarios.mjs), including the data-safety guards named throughout this page — soft-delete, delete-scope, demo read-only, provenance, connect consent/detach, private-vault isolation, and identity checks among them.
Where we draw the line
Just as important as what we promise is what we don’t. A few things we deliberately do not claim, because they wouldn’t be true:
- We’re not locked out of your data. Your financial figures live in our database and are readable by us to operate the service. We protect them with database-enforced isolation and encryption in transit, we hold ourselves to least-privilege access, and we log every change — rather than claiming a technical impossibility we can’t honestly stand behind.
- Beyond the platform’s storage encryption and the encrypted tokens we use for bank connections, we don’t add our own separate at-rest encryption of individual financial figures — so we don’t market one.
- Bank connections refresh on a schedule, not the instant a balance changes — so we don’t call it real-time.
- Two-factor authentication is optional. We make it easy to turn on; we don’t claim it’s mandatory.
The framing we hold to: here’s what’s enforced in code, here’s what’s our contractual promise, and here’s what we deliberately don’t claim.
Your businesses on Continuum
If you own part of a closely-held business, Continuum keeps the part that belongs to your estate— not your business’s day-to-day books.
- What we hold: your ownership stake and what it’s worth, what you paid or your tax basis, the income the business pays you, and the documents that matter if something happens to you — operating agreement, buy-sell or succession plan, valuations, and K-1s.
- What we reference: your business’s own bank accounts, cards, and bookkeeping. We note that they exist and where they’re managed so a successor knows where to look — but we don’t pull in the business’s transactions.
- What we leave alone: bookkeeping, payroll, invoicing, business P&L. Your business already has tools for that. Continuum is the owner’s-eye view on top.
One thing we’ll always ask: if you’ve borrowed against your business — or any asset — and personally guaranteed that loan, tell us. It’s exactly the kind of thing your family needs to know, and we make it visible where it matters.