What WealthCEO does with your information, who can see it, and what we haven’t built yet. We’d rather you hear the gaps from us.
Last updated October 20, 2026
No. WealthCEO never moves money, places or stages a trade, transfers funds, changes a beneficiary, files anything electronically, binds insurance or signs, whether by a click, a rule or an automated check. It watches, suggests and prepares. You act.
This isn’t a setting. The automated checks that write to your Inbox are limited in the database itself to watching, suggesting and preparing; nothing that executes exists to switch on.
No. During the beta there are no live connections to banks or brokerages, and we never ask for the login to one. If live connections come later, this page will explain how they work before they’re switched on.
Only the members of your household and the people you invite. Every record belongs to exactly one household, and the database enforces it: each request is checked against your membership before a single row comes back. It isn’t only the screens that hide other households’ data; the database won’t return it.
Each person gets a role, such as spouse, bookkeeper, CPA, attorney, adviser or heir. The role only suggests a starting point: you choose exactly which areas they see (wealth, books, tax, legal, documents, budget), whether they can download, and which entities they can see.
You can set the date their access ends. After that date, they’re out, without you having to remember.
Yes. Every invitation, and every change to someone’s role, areas, entities or end date, is written to an access log as it happens. Entries can’t be edited, and only the household’s owner can read the log.
Our staff tools don’t include household financial data. The admin portal can show that a member exists and how many households they belong to; it doesn’t show balances, books or documents, and there’s no feature that lets staff sign in as you. Staff sign in separately from members, and every change they make is logged.
As at any software company, the engineers who run the database can technically reach what’s stored in it. We keep that to the people who need it.
With your email and a password of at least 12 characters.
Yes. You can add an authenticator app in Settings. Once you have, your household’s data can only be reached from a session that has passed the second step, enforced by the database rather than the screen. Two-step verification is optional today.
The database and sign-in run on Supabase, a managed Postgres platform that encrypts stored data at rest. The app runs on Render, and this website on Vercel. Every connection uses HTTPS.
The hosting region for production hasn’t been finalized; this page will name it when it is.
Not today. The alerts in your Inbox come from fixed rules, not a model, and they already run under a switch that stops them, a pause for each one, and a ceiling you set for your household.
When AI arrives, it will be opt-in, one action at a time, under those same controls. It will explain the numbers; it will never invent one, and it will never move money.
Nothing until you accept cookies: analytics are off by default. With your consent, we measure which sections were viewed, which links were clicked, and whether a form was started or sent.
We never send what you type, into the beta request form or into any of the free tools. The calculators run entirely in your browser.
It’s stored in our database, where nothing on this website or in the app can read it back. Only our team reviews requests.
Every page is served over HTTPS only, with a strict content security policy that blocks scripts we didn’t put there, and headers that stop the site being framed by another one or leaking where you came from.
A private beta is the time to say this plainly. None of these are true today:
Ask when you request access, and tick “I’d like a call”. We’ll walk you through anything on this page.