SignalWealth is the CRM, client portal and content studio that independent advisory firms and insurance agencies run their practice on. Your firm owns the data it puts in SignalWealth. We act as your service provider: we use it only to run the service for you, we never sell it, and we never use it to train AI models.
At a glance
- Encryption in transit (TLS 1.2 or 1.3 only) and at rest (encrypted database disk, documents, recordings and backups)
- Two-factor sign-in required for firm admins and SignalWealth staff, enforced on our servers; passkeys for anyone who wants them
- Firm isolation: every request is limited to one firm, and cross-firm access checks run in the automated tests before every release
- Nightly encrypted backups stored off the server in a separate, versioned AWS account bucket; every release restores the latest backup to prove it works
- Weekly vulnerability scans and daily automatic security updates
- Quarterly access reviews of everyone and everything that can reach client data
- Breach notice to your firm without undue delay, and no later than 72 hours after we become aware of unauthorized access to your customer information
- No SOC 2 report yet. We run on written, signed policies modeled on SOC 2. No audit has been performed.
Hosting & encryption
- The platform runs on Amazon Web Services in the United States (US East, N. Virginia).
- All public addresses use HTTPS with TLS 1.2 or 1.3 (older versions are switched off) and HTTP Strict Transport Security. Internal services listen only inside the server.
- The database lives on an AWS block-storage disk that is encrypted at rest. Client-portal documents, call and meeting recordings are kept in private, encrypted, versioned object storage. Backups are encrypted (AES-256).
- Sign-in secrets for connected Google, Microsoft, Zoom, Meta, LinkedIn, YouTube and Plaid accounts, and two-factor secrets, are encrypted again inside the application before they are stored.
- Files clients upload to the portal are checked for file type and scanned for viruses before anyone can open them.
Sign-in & access
- Two-factor sign-in (an authenticator app code) is required for every firm admin and every SignalWealth staff account. It is enforced on the server, so there is no way around it in the browser or the mobile app. Other users can switch it on, and are reminded weekly until they do.
- Passkeys (Face ID, Touch ID, Windows Hello or a security key) can be added by any user, who can then require a passkey for every sign-in. Client-portal users sign in with a one-time code sent to their email and can add a passkey too.
- Repeated wrong passwords lock the account for a while. Sign-ins expire, and can be cut off immediately.
- Roles decide what each person can see and do. Your firm's admins add and remove your users.
- When an admin removes a user, their sign-ins are cut off at once, and their connected accounts, AI connections, API keys and trusted devices are revoked. Each removal produces a receipt.
Firm isolation
Every request is tied to one firm, and every database query is limited to that firm. An address that doesn't belong to a firm gets nothing. Client-portal users see only their own household. The automated tests that run before every release include checks that one firm's users cannot reach another firm's records.
Backups & recovery
- The database is backed up every night and before every release. Each backup is checked, then copied to a separate, private, encrypted and versioned storage bucket. The account that writes backups cannot delete them.
- Every release restores the newest backup into a scratch database and runs the upgrade against it, so we know backups restore.
- Backups are kept for 35 days, then expire automatically.
- Client-portal documents and recordings are stored with versioning, so a deleted or overwritten file can be recovered.
- Every release can be rolled back automatically if its health checks fail.
- We run in one AWS region. Our recovery plan, targets and their limits are in the due-diligence packet.
Patching & vulnerability scans
- Operating-system security updates install automatically every day.
- A weekly automated scan checks for pending security updates and audits the platform's software libraries against public vulnerability databases. Findings are emailed to our security officer.
- Libraries are pinned to exact versions and updated through the same tested release process as code.
- Not yet in place: an external vulnerability scan and an independent penetration test. Both are planned.
How changes ship
Every change is built in an isolated development copy that runs on scrubbed data (third-party sign-ins removed). Before anything reaches customers it passes the full automated test suite, a restore of a fresh backup, and end-to-end checks, and only our security officer can release it. Each release takes a backup first and rolls itself back if a health check fails.
Our own access
- Only named SignalWealth staff hold administrative access, and only to run, support and repair the service. Their changes in a firm are recorded in an audit log with before-and-after values.
- Server access requires a named login through a private, identity-checked network; the public SSH port is closed. AWS access requires multi-factor authentication.
- The application runs as an account with no administrator rights. Automated keys can do only their one job.
- Secrets live in restricted files on the server, never in code, documents or chat.
- We review all access every quarter and keep a record of each review.
AI & your data
- We do not use your firm's data or your clients' information to train AI models, and we do not sell it.
- AI features send only what a request needs to our AI providers' business APIs (for example, a call transcript for a summary). Which providers, and for what, is on our subprocessor list.
- AI features that touch client conversations (call notes, meeting notes, the texting and website assistant) are off until your firm turns them on.
- The AI connector for ChatGPT, Claude or any AI assistant that supports MCP connectors saves what it builds switched off, and cannot send, schedule, switch on or delete anything.
Retention & deletion
- Your data stays while your subscription is active and until your firm deletes it.
- When a firm leaves, it can export its data. When we delete a firm, a closure archive is kept for 90 days in case of a mistake and then deleted automatically. Backups expire within 35 days.
- Disconnecting a connected service deletes its stored sign-in and, for bank and investment accounts, ends the connection at Plaid.
Incident response
We keep a written incident response plan. If we become aware of unauthorized access to your firm's customer information in our systems, or those of one of our subprocessors, we notify your firm's admins without undue delay and no later than 72 hours after becoming aware of it. The notice says what we know (what happened, when, which information and which clients appear to be affected, and what we've done), and we follow up as we learn more. We give you the facts you need for any notices you must send, and we cooperate with your investigation. This is the service-provider notice the SEC's amended Regulation S-P expects of firms' vendors.
To report a security concern, email security@signalwealth.io.
Subprocessors
The outside services that process data for us, what each one handles and where, are listed on our subprocessor page. We give firm admins at least 30 days' notice before a new subprocessor starts receiving customer data.
Compliance status
- Written, signed security policies: information security, access control, incident response, backup and recovery, change management, vendor management, data retention.
- SOC 2: our policies follow SOC 2 control expectations. We have not had a SOC 2 audit and do not have a SOC 2 report.
- Our hosting and payment providers hold their own SOC 2 and PCI reports.
Due diligence & contact
For your vendor review, we provide a due-diligence packet (standard questionnaire answers, our recovery plan and policy summaries) and a Data Processing & Security Addendum your firm can sign online. Ask through our support page or at security@signalwealth.io.