Security at PeakWorth™
Last updated: April 30, 2026
Security at a glance
- Bank connections through Plaid are read-only — PeakWorth cannot move your money.
- We never receive or store your bank password.
- Your data is encrypted in transit and at rest.
- Passwords are securely hashed — never stored in plain text.
- Optional two-factor authentication helps protect your account.
- Sessions are protected with secure, server-side revocable cookies.
- You can permanently delete your account and data at any time.
- Questions? Email us anytime at support@peakworth.com.
Read the full security overview below for how each protection works.
A note from the founder
I built PeakWorth after years of relying on detailed financial models to make major decisions for my own family—from career moves to home purchases to retirement planning. Professionally, I've spent my career helping technology companies make complex financial decisions as a CFO, and I previously practiced as a licensed CPA. Those experiences shaped how I think about balancing today's choices against long-term financial outcomes.
Over time, I realized households deserved the same kind of decision engine that businesses rely on. That's why I built PeakWorth—to help people make better financial decisions with greater confidence and a clearer understanding of the long-term tradeoffs.
If you trust us with your financial information, I believe we owe you complete transparency about how we protect it. PeakWorth exists to help people make better financial decisions—not to monetize their financial data or push financial products.
How your data moves
Always encrypted in transit
Every connection between your browser and PeakWorth uses HTTPS with TLS 1.2 or higher. Strict-Transport-Security tells your browser to refuse any downgrade to plain HTTP for the next six months after your first visit.
Bank tokens encrypted at rest, separately
When you connect a bank through Plaid, the access token Plaid hands back is encrypted with AES-256-GCM before it touches our database. The encryption key lives in our secrets manager — not in the database — so a database-only leak can't decrypt those tokens.
Provider-managed encryption at rest
The PostgreSQL database itself is encrypted at rest by our hosting provider. Backups are encrypted and retained for up to 30 days for disaster recovery.
How your account is protected
Hashed passwords, never stored in plaintext
Passwords are hashed with bcrypt at cost factor 12. We never see, log, or echo back your raw password.
Two-factor: authenticator apps and passkeys
You can turn on two-factor sign-in from your Account page. We support standard authenticator apps (Google Authenticator, 1Password, Authy, etc.) with single-use backup codes, and passkeys / security keys (Touch ID, Face ID, Windows Hello, YubiKey). Passkeys also let you sign in without a password. If you ever lose access, there's a 24-hour-delay self-serve recovery flow that emails the account owner first.
HTTP-only sessions with server-side revocation
Sessions use signed, HTTP-only, Secure cookies. Logging out, resetting your password, or deleting your account immediately invalidates outstanding sessions on the server side — not just in your current browser.
Rate limiting on login and registration
Login and registration are rate-limited globally across our servers, so an attacker can't get more attempts by hitting different instances of the app.
Bank linking
AI Advisor — what we send and what we don't
Session replay — how masking works
With your consent, we record masked session replays of the web app (never the mobile app) using PostHog. Replay is designed to mask sensitive content before it leaves your browser:
- Account balances, transaction amounts, merchant names, account names, and Plaid institution data are replaced with grey boxes in the recording.
- All form inputs (including everything you type into the AI advisor, CSV import preview rows, profile fields, and email/password fields) are masked at the source — PostHog never receives the underlying characters.
- Network request headers and bodies are NOT recorded — only the rendered DOM.
- Cross-origin iframes (Plaid Link, Stripe Checkout) are excluded from recording entirely.
- Only a small allowlist of non-sensitive UI (navigation buttons, modal titles, generic CTAs, error messages) is opted back in via PostHog's `ph-capture` class so replays remain useful for debugging UX issues.
You can withdraw consent at any time from the cookie banner or the Account page. Replays are automatically deleted no later than 90 days after they are recorded.
Analytics — what our analytics vendors actually see
Who at PeakWorth can see your data
Internal access to user accounts is role-limited and logged. Every PeakWorth staff member who can open an admin surface holds an explicit role (support read, support write, on-call engineer, or admin) — a new staff account has no access until an admin grants one. Every time a staff member opens a page that surfaces another user's data, an append-only, hash-chained access-log row is written: who looked, at whose account, on what URL, with what reason. The log can't be silently edited or deleted, and an admin reviews it monthly.
Data deletion
If something ever goes wrong
We'll tell you, quickly
If we ever confirm unauthorized access to your financial data sourced from Plaid, or to your password hash or session, we'll email you within 72 hours. The notification will explain what happened, what data was involved, what you should do, and how to follow up with us. Lower-impact incidents are communicated within 7 days.
For real-time visibility — beyond the email we send when something affects your account — our public status page shows the current health of every PeakWorth subsystem (web app, API, database, Plaid, Stripe, Anthropic, Resend) and a 90-day incident history.
Subprocessors
These are the only third parties that receive any of your data, and only the slice they need to do their job:
PlaidSecurity overview ↗Bank account linking. Receives bank credentials directly from you (via Plaid Link) and returns transaction and balance data.
StripeSecurity overview ↗Subscription billing. Receives your email and payment details (entered into Stripe's hosted checkout — we never see your card number).
AnthropicSecurity overview ↗AI advisor responses. Receives financial context with direct identifiers (name, email, account numbers) removed, plus the messages you type into the AI chat.
ResendSecurity overview ↗Transactional email delivery (welcome, billing, security notifications).
ReplitSecurity overview ↗Application hosting and managed PostgreSQL database.
Reporting a vulnerability
If you believe you've found a security issue in PeakWorth, please email us. We'll acknowledge within three business days and credit you in the fix release notes if you'd like.
More detail
For the full picture, see our Privacy Policy and Terms of Service.