Security

1. What This Page Is

Telemetry holds the financial picture of your household, so the reasonable question to ask before connecting anything is what we actually do to protect it. This page answers that in plain language, and it says what we do not do as well as what we do.

Behind it sits a Written Information Security Program, the formal control document we maintain under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule. That document is not published, because it enumerates our controls, our tooling and our procedures in a level of detail that would help someone attacking us more than it helps you. We provide it on request to auditors, partners conducting a security review, and prospective business customers. Write to security@telemetrywealth.com.

Everything on this page is a description of controls that are in place today. Where something is planned rather than built, it says so.

2. Encryption

• Traffic between your browser and Telemetry is encrypted with TLS, and the application is served over HTTPS only
• Your data is encrypted at rest in our database using AES-256, as are our backups, our logs and our secret storage
• Credentials we hold on your behalf, such as the read-only token a data aggregator issues for your bank, are encrypted a second time in the application before they are written to the database. The key for that lives in a managed secret store, not in our source code
• Our database accepts encrypted connections only, and it has no public network address

3. Separation Between Households

Your household's data is isolated at the database itself, not only in application code. Each request is bound to your household, and the database refuses to return rows belonging to anyone else even if a query asks for them. This matters because application-layer checks are written by people and can be forgotten in one place out of hundreds, whereas a database rule applies to every query by default.

Within your household, permissions are granular. A member can be given the ability to manage budgets without the ability to add or remove accounts.

The AI assistant reaches the database through a separate, read-only identity that can select data and nothing else, is bound to your household by the same rule, and is cut off automatically if a query runs long.

4. Signing In

• Sign-in is handled by Google Identity Platform. We never see or store your password
• Accounts created on or after August 21, 2026 must verify their email address
• Two-factor authentication is available to every customer as an authenticator-app code, and it is required before you can connect a financial institution. It is optional for everything else, so the application stays fully usable without it
• Enrolling issues ten single-use recovery codes. We store only a hash of them and cannot read them back. A recovery code cannot be typed at the sign-in screen and does not by itself grant access. Using one to remove a lost second factor is done by a person at Telemetry, against a code you present, and is recorded against that person's identity

5. Connecting Your Accounts

• Bank and card connections use read-only access. Your banking username and password never pass through Telemetry, and nothing we hold can move money
• An account can have exactly one active feed at a time, enforced by the database rather than by convention, so two connections cannot quietly double-count the same transactions
• You can disconnect an integration at any time, and you can use Telemetry entirely from file imports and manual entry without connecting anything

6. Administrative Access

Administrative access to Telemetry uses a completely separate identity store from customer accounts, on a separate address, with its own password and its own required second factor, per-account lockout and rate limiting. A customer account cannot become an administrator, and an administrator does not sign in through the customer application.

Access to production infrastructure is limited to one person, the Qualified Individual named in our security program, and requires multi-factor authentication. We review who holds what access at least annually and record the result in writing. The most recent review was completed in August 2026.

7. How Changes Reach Production

• Every production release is a specific, named commit, and it is deployed by a script rather than by hand
• An automated test suite of more than nineteen hundred tests runs against a real database on every change, and includes tests written specifically to catch a household seeing another household's data. A release refuses to proceed unless that suite passed for the exact commit being released
• Database changes are versioned migrations only. Nobody edits the production database directly
• Any release can be rolled back to a previous version within minutes
• Automated security, architecture, quality and documentation reviews run weekly against our own source code, and their findings are recorded in the repository and worked to resolution

8. Finding And Fixing Vulnerabilities

We look for vulnerabilities in three ways, all automated: a weekly analysis of every third-party library we depend on, a scan of each production container image at the moment it is published, and a weekly check of whether anything we run has reached end of life.

Once a vulnerability is found and a fix exists, we commit to remediating it within fourteen days if critical, thirty days if high, and ninety days if medium, measured from the day we detect it. Where no fix has been published by the upstream maintainer, we track it and apply the fix when one appears.

If you believe you have found a security problem in Telemetry, email security@telemetrywealth.com. That address is also published at telemetrywealth.com/.well-known/security.txt. Tell us what you found and how to reproduce it. We aim to acknowledge a report within three business days and to tell you what we intend to do about it within ten. We will not pursue anyone who reports a genuine issue to us in good faith and gives us a reasonable chance to fix it before telling anyone else.

9. Monitoring And Incidents

• An external check probes the application every five minutes from three regions. It runs a real database query rather than merely asking whether the server is up, so it can tell a working application from a running one
• Errors logged in production raise an email alert, and a loss of availability raises both an email and a text message. The notification channels are tested rather than assumed
• We keep a written incident-response procedure with defined time targets: assess within one hour, contain within four. It starts with a read-only diagnostic that changes nothing, because the first action in an incident should never be a guess applied to production
• If an incident is ever found to affect customer information, we notify affected customers as required by law, and we notify regulators where the law requires it

10. Data Retention And Deletion

• You can export all of your data yourself at any time from your profile, in a machine-readable format
• You can request deletion of your account at any time by writing to privacy@telemetrywealth.com. Deletion runs as a single transaction that removes every record belonging to your household and then verifies that none survive. If verification fails, the whole thing is rolled back rather than reported as done
• Database backups are retained for seven days and then deleted automatically. Application logs are retained for thirty days
• Logs are written so that direct identifiers such as email addresses are hashed rather than recorded in readable form

11. What We Do Not Claim

• We are not SOC 2 certified. Formal certification is a goal for the commercial product, not something we have today, and we would rather say so than imply otherwise
• We have not yet had an independent penetration test. One is scheduled for the launch of the commercial product and annually after that
• Telemetry is a small company. The controls on this page are real and are automated wherever automation is possible, precisely because a small team cannot rely on having someone watching a screen

12. Third Parties

The companies that help us run Telemetry, and exactly what data reaches each one, are listed at telemetrywealth.com/subprocessors. Every one of them is under a written agreement to protect your information, to use it only to provide their service to us, and to tell us promptly if they suffer a breach.

13. Questions

Email: security@telemetrywealth.com for anything on this page, or privacy@telemetrywealth.com for a question about your own data.