How We Protect Your Data

Encryption

Data in Transit (TLS 1.3)

All communication between your browser and our servers is encrypted using TLS 1.3 — the latest and most secure version of the Transport Layer Security protocol. This protects your data from interception during transmission. PlainWealth enforces HTTPS for all connections, and we use HSTS (HTTP Strict Transport Security) to prevent downgrade attacks.

Data at Rest (AES-256)

All stored data — including financial records, transaction history, and personal information — is encrypted at rest using AES-256, the same encryption standard used by financial institutions and government agencies. Encryption keys are managed through a secure key management service with strict access controls.

Password Security

Bcrypt Hashing

User passwords are never stored in plain text. We use bcrypt — a slow, computationally expensive hashing algorithm — with a unique, randomly generated salt for each user. This makes password cracking via brute force or rainbow table attacks computationally infeasible.

Password Requirements

We require passwords to be at least 8 characters. We strongly recommend using a password manager to generate and store strong, unique passwords. PlainWealth supports passwords up to 128 characters.

Authentication Security

Login Alerts

When you log in from a new device or location, we send an immediate email alert to your registered email address. This allows you to detect and respond to unauthorized access quickly.

Session Management

Sessions are secured with HTTP-only, Secure, and SameSite cookies. Sessions automatically expire after a period of inactivity. You can view and revoke active sessions from your Account Settings.

Rate Limiting

Login attempts are rate-limited to prevent brute force attacks. After a threshold of failed attempts, the account is temporarily locked and the user is notified via email.

Infrastructure Security

Cloud Infrastructure

PlainWealth is hosted on AWS (Amazon Web Services) infrastructure, which provides physical security, network firewalls, DDoS protection, and compliance certifications (SOC 2, ISO 27001). Our database instances run in private subnets with no direct internet access.

Network Security

We use Web Application Firewall (WAF) rules to protect against common web vulnerabilities including SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). All API endpoints require authentication and are protected by CORS policies.

Security Monitoring

Continuous Monitoring

Our systems are monitored 24/7 for unusual activity, potential intrusions, and performance anomalies. Automated alerts notify our security team of suspicious patterns.

Regular Audits

We conduct regular security audits including automated vulnerability scanning, dependency checks, and manual code reviews. Critical vulnerabilities are patched within 24 hours of discovery.

Non-Custodial Architecture

PlainWealth is a tracking tool only. We do not hold, manage, or have access to your investment funds or banking credentials. This architecture means:

• Even in the unlikely event of a breach, attackers cannot access your investment accounts or funds.
• You maintain full control over your financial accounts at all times.
• We do not store bank login credentials or trading authorization tokens.

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly by emailing security@bogle.web.id. We take all reports seriously and will respond within 48 hours. We do not currently operate a bug bounty program but acknowledge researchers who report valid vulnerabilities.

Compliance

While PlainWealth is not a financial institution and is not subject to the same regulatory requirements as banks or brokers, we voluntarily adhere to industry best practices for data security and privacy. Our practices are designed to align with NIST cybersecurity framework guidelines.