Information Security Policy

Last updated: October 25, 2026 · Version 1.4

At WellAhead, protecting your financial data is the point, not an afterthought. This Information Security Policy describes how we safeguard the confidentiality, integrity, and availability of the data you entrust to us. It complements our Privacy Policy and Terms of Service.

WellAhead is provided by CleverMind AI LLC ("CleverMind," "WellAhead," "we," "us," or "our"). WellAhead is a personal-finance application that helps you understand your spending and progress toward your savings goals. It connects to your financial accounts read-only through our data provider and does not move money.

1. Governance & responsibility

Security is owned by our Founder & Security Lead and treated as a cross-cutting requirement in every change, not a separate step. Security communications are received and monitored at security@getclevermind.com. This policy is reviewed at least annually and whenever a material change occurs (a new data type, a new service provider, an architectural change, or a security incident), and is versioned on each update, so the program is maintained and matured over time.

2. The data we handle

We handle the minimum data needed to provide the Services, and we classify it so the most sensitive data gets the strongest protection:

• Highly sensitive: the access credentials that link your bank, and our encryption keys. Encrypted at rest, never logged, never shared, and never stored on your device.
• Financial: your transactions, balances, and account details. Isolated per user, encrypted in transit, and access-controlled.
• Personal: your sign-in identity and the preferences you tell us. Minimized and access-controlled.

Data minimization is a design principle: we collect and keep only what the product needs, and prefer aggregated or de-identified data wherever it is enough.

3. Encryption

• At rest: envelope encryption. The credential that links your bank is never stored in plaintext. Each user has a unique data key that encrypts their credential, and each of those keys is itself encrypted ("wrapped") by a separate key held in a managed key service. A stolen copy of our database cannot decrypt anything without that wrapping key, and each user's key can be rotated independently.
• In transit. All traffic to our production services is encrypted with TLS 1.2 or higher. Sensitive data never travels over an unencrypted connection.
• Key management. Wrapping keys live in a managed key service, are never committed to source control or stored next to the database, and are retained long enough to keep encrypted backups recoverable. Rotation procedures are defined and implemented.

4. Access control & authentication

• Your data is isolated at the database layer. Every table that holds your financial and personal data uses database Row-Level Security, enforced so that not even an application-code mistake (or the table owner) can expose another user's financial or personal data. A few internal operational tables, such as background-job queues and push-notification token records, and global reference tables are scoped by explicit per-user checks instead; these hold no financial data.
• Least privilege. The application connects using a restricted database role that cannot bypass those isolation rules and owns nothing, so there is no elevated access to escalate to. Schema changes use a separate administrative role.
• Managed authentication. Sign-in is handled by a managed identity provider that issues short-lived access tokens with refresh and the ability to revoke sessions. Every request is verified before any data is returned.
• Administrative access to production systems, source control, and key stores is limited to authorized personnel and protected by multi-factor authentication.
• Secrets (credentials and API keys) are never committed to source control and are kept in managed secret storage.

5. Data sharing & de-identification

We do not sell your data, and we share it only with the service providers needed to run WellAhead. Before any data is sent to an AI provider, it is de-identified: your name, account numbers, and contact details are removed, and this constraint is enforced programmatically. For categorizing a transaction we send only its description and amount. To generate insights and answer your questions, we send de-identified summaries that do include real financial figures such as balances and amounts, so the coach can be specific, but never your name, account numbers, or contact details (our Privacy Policy describes this in detail). Our current service providers cover financial connectivity, managed database and authentication, one-time-passcode delivery, push notifications, merchant logos, and AI processing on de-identified data only. New providers are reviewed for their security and privacy posture before we adopt them.

6. Secure development

All changes are version-controlled and reviewed before release, and the database evolves only through versioned migrations. Automated tests, including adversarial checks that one user cannot read or write another's data and that forged or expired sign-in tokens are rejected, run on every change, and changes that fail are not shipped. We keep dependencies current and patch known vulnerabilities within a defined SLA (critical within 7 days, high within 30 days, and medium or low within 90 days or the next release).

7. Logging, monitoring & auditability

Security-relevant events (sign-ins, calls to our data provider, key operations, and automated decisions) are logged to support detection and investigation, and logs are structured to avoid recording secrets or unnecessary personal data. Access to systems and data is designed to be attributable and reviewable.

8. Incident response

Suspected incidents are reported to security@getclevermind.com. Our Security Lead triages, contains, and remediates incidents and preserves relevant evidence. We can revoke compromised sessions, rotate keys and credentials, and terminate the sessions of a reported lost device. We notify affected users and relevant partners of confirmed breaches of personal data without undue delay, consistent with applicable law and our contractual obligations.

9. Data retention, deletion & portability

We retain data only as long as needed to provide the Services. You may request deletion of your data; deletion removes the data we hold and revokes bank access at the source. You may also request an export of your data. Our data provider's own retention is governed by their policy, which our Privacy Policy describes accurately.

10. Business continuity & backups

Production data runs on managed infrastructure with automated backups, and wrapping keys are retained at least as long as any backup that references them so encrypted backups remain recoverable.

11. Changes to this policy

This is a living policy. We review it on the cadence above, update it as the program matures, version it on each change, and communicate material changes to relevant partners as required.

12. Contact us

Questions about this policy or our security practices? Contact us at:

CleverMind AI LLC
13802 N Scottsdale Rd, Suite 151-52, Scottsdale, AZ 85254-3403
security@getclevermind.com