Opening your workspace
Gathering the page you requested.
Trust & security
Recorded system status, protection practices, and the history of security reviews.
Recorded status
All systems operational
This is a maintained record, not a live availability monitor.
Last security audit: Jun 21, 2026, 6:00 PM
Front door
Sign-in & the public questionnaire
Client portal
Highlights, modules, profile
Advisor workspace
Today, prospects, planning
Module platform
Registry, event bus, shared store
Data & audit engine
Statement parsing, look-through, frozen audits
Encrypted in transit
All traffic runs over HTTPS with HSTS, and strict security headers ship on every response.
Hardened by default
No third-party trackers or ad scripts. Frame embedding denied, content-type sniffing blocked, server fingerprinting off.
Audited continuously
Automated dependency audits run on every change and on a daily schedule. New advisories open alerts automatically.
Private, reviewed code
Source lives in a private repository. Every module lands through a reviewed pull request against the chassis contract.
Your data stays in the app
Client statements and holdings live in our own access-controlled database and are never sold or shared with third parties. The public demo runs on a pseudonymized sample household.
Per-user authentication
Advisors sign in with individual accounts and hashed passwords; the workspace is gated per user, on top of a site-wide password wall. Single sign-on and MFA are on the roadmap.
Authentication hardening
Jun 21, 2026, 6:00 PM · Fiat engineering
Replaced the placeholder sign-in with real per-user advisor authentication — hashed passwords (scrypt), signed session cookies, and a server-side gate on the workspace. Sign-in attempts are logged. Verified by automated tests and end-to-end checks.
Full chassis security audit (manual)
Jun 10, 2026, 2:05 AM · Fiat engineering
Passed — 0 high/critical findings. 2 moderate upstream advisories accepted (build-time only, no untrusted input) and tracked for the patched release.
Dependency, secrets & injection scan
Jun 10, 2026, 2:05 AM · Automated + manual
No secrets in source · no unsafe HTML injection paths · all external links hardened · security headers added to every response.
Scheduled dependency audit
Every push + daily · Automated (GitHub Actions)
Runs on every code change and every morning on a schedule; fails the build on high-severity advisories and opens alerts for anything new.
Questions about security, or something to report? Email cooper@fiatwm.com. We read everything.