Security and audit status

Security, checked by someone other than us

A clear account of what protects your data today: an independently tested app, encryption in transit and at rest, and an architecture that never collects the credentials worth stealing in the first place.

No open banking connectionSMS never leaves the deviceEncrypted in transit & at rest

Independent validation

Where NetWorth+ actually stands

  • Data encrypted in transit & at restGoogle Cloud & Firebase infrastructure
  • Independent penetration test completedFull app scope, no issues found
  • No bank credential ever collectedThe thing worth stealing is absent
  • Per-user rules enforced server sideAn account reads only its own records

In short

An independent penetration test has been completed, covering the full scope of the app, including how data is protected in transit and at rest, with no issues found. Data is encrypted in transit and at rest on Google Cloud and Firebase infrastructure, which carries ISO 27001 and SOC 2 certification from Google. The app has no open banking connection, collects no bank credential and cannot initiate a payment, so the material most worth stealing from a finance app is never present to steal. Bank alert SMS is read and parsed on the device and the message text is not uploaded. No full card number is ever stored, and sign-in runs on Firebase Authentication, so no password is stored by NetWorth+ at all. Access rules enforced on the server mean one account can only ever read its own records, rather than that restriction living in app code where a modified client could ignore it. Security reports go to support@networthplus.in and are read before feature work.

Data encryption

In transit & at rest

Third-party pen test

Completed, no issues found

Card numbers stored

None, ever

Passwords stored by us

None, Firebase Auth

Enterprise grade

Enterprise infrastructure, AES-256 encryption

This is the single most misused claim in finance app marketing, so it is worth separating carefully.

The server layer

NetWorth+ runs on Google Cloud and Firebase, the enterprise platform behind regulated financial and healthcare workloads worldwide. It is independently certified to ISO 27001, ISO 27017, ISO 27018 and SOC 1, 2 and 3, audited annually by third parties, and operated from data centres with hardware-level security, continuous monitoring and strict physical access control.

The encryption layer

Your ledger is encrypted twice over, and neither layer is optional. In transit, every connection runs over TLS, negotiated at TLS 1.3 with modern devices. At rest, your data is encrypted with AES-256, with keys held, managed and rotated inside Google’s key management infrastructure.

The durability layer

Every record is written to multiple independent zones, so the loss of a disk, a machine or an entire data centre does not lose your ledger. Auto-backup can be scheduled daily, weekly or monthly and export is available at any time.

The application layer

Certified infrastructure says nothing on its own about the code running on top of it, which is why the NetWorth+ application was independently penetration tested across its full scope, including how data is protected in transit and at rest. The test found no issues.

Check by check

Independent validation, stated plainly

The list a due diligence reader works through, with our actual status against each line rather than a general reassurance.

Independent checkStatus todayWhat that means in practice
Third-party penetration testCompletedAn independent tester assessed the app across its full scope and found no issues.
Data encryptionIn placeData is encrypted in transit and at rest on Google Cloud and Firebase infrastructure.
Vulnerability disclosure routeIn placeA published address, a commitment to read security mail first, and a request for a reasonable window before public disclosure. Detailed below.
Published security overviewThis pageThe written account of architecture, data handling and protections that a reviewer would otherwise have to request by email.
Infrastructure certificationHeld by GoogleISO 27001 and SOC 2 apply to the Google Cloud and Firebase platform underneath the app.

This table is updated whenever a new independent check is completed. Last updated August 2026 to reflect the penetration test above.

Threat model

What the design takes off the table

The strongest security property an app can have is not holding the dangerous thing in the first place. Four decisions do most of the work here.

No bank credentials

NetWorth+ never asks for a bank username, password or open banking token, and has no aggregator integration. A total compromise of our systems yields no way into anybody's bank account, because that material was never collected.

No payment rail

The app cannot move money. It has no payment capability to abuse, so the highest value attack against a finance app, initiating a transfer, does not exist against this one.

SMS parsed on device

Bank alert messages are read and interpreted on your phone. The message text is not uploaded, so there is no server-side store of your SMS to breach. The feature is optional on Android, and off until you switch it on.

Rules enforced server side

The restriction that an account can read only its own records lives in server-enforced access rules, not in app code. A modified or rebuilt client cannot argue its way past them, because it is not the client making the decision.

Blast radius

If we were breached tomorrow, what would it reach

The useful question is not whether a breach is possible, it is what a successful one would actually be worth. Here is the honest inventory.

DataReachable in a breach of our systems?
The ledger you built: accounts, balances, transactions, categories, budgets and goalsYes. This is the substance of what NetWorth+ stores, and a breach would expose it.
Shared expense records and settlements with other peopleYes, for the records connected to the affected account.
The email address on your accountYes.
Your bank username, password or any open banking tokenNo. None is ever collected, so none exists to take.
The content of your bank SMS messagesNo. Message text is processed on the device and is not uploaded.
Your full credit or debit card numberNo. NetWorth+ never stores a full card number. Card records in the app are the cycle, limit and due-date details you enter, not the card itself.
Your account passwordNo. Sign-in runs on Firebase Authentication and NetWorth+ stores no password.
The ability to move money out of any accountNo. The app has no payment capability whatsoever.

Stating this openly is deliberate. An app that will not tell you what a breach would expose is asking you to assume the answer is nothing, and it never is.

Responsible disclosure

Found something? Here is the route

A direct line to the team, not a ticket queue: a real address, a fast read, and credit where you want it.

1

Write to us

Send the detail to support@networthplus.in with enough information to reproduce the issue. Security mail is read before feature work.

2

Give us a window

Please allow a reasonable period to investigate and ship a fix before disclosing publicly. We will tell you what we find rather than going quiet.

3

Test in good faith

Use your own account and your own data. Do not access another person's records, degrade the service for others, or run destructive tests.

4

Take the credit

If you would like to be credited for the report once it is fixed, say so and you will be. If you would rather stay anonymous, that is fine too.

The fair summary of this page

NetWorth+ has a narrow attack surface by design: no bank credentials collected, no payment capability, and per-user access rules enforced on the server. That design has been independently penetration tested across the app's full scope, with no issues found, and your data is encrypted in transit and at rest on Google Cloud and Firebase infrastructure.

Questions

Good to know

Has NetWorth+ had an independent security audit or penetration test?
An independent penetration test has been completed, covering the app's full scope, including how data is protected, with no issues found. Data is encrypted in transit and at rest on Google Cloud and Firebase infrastructure.
How do I report a security issue?
Write to support@networthplus.in with enough detail to reproduce it. Security mail is read before feature work, and if you would like credit for a valid report once it is fixed, just say so.
Do you store my password?
No. Sign-in runs on Firebase Authentication, so authentication credentials are handled by Google's identity service and no password is stored by NetWorth+.
What would a breach of your systems actually expose?
The ledger you built, meaning your accounts, balances, transactions, categories, budgets, goals and shared expense records, along with the email address on your account. It would not expose any bank credential or open banking token, because none is ever collected; it would not expose your SMS content, which is processed on your device and not uploaded; and it would not allow money to be moved, because the app has no payment capability.
Do you store my card number?
No. A full credit or debit card number is never stored. What the app holds for a card is the information you enter to track it, meaning the statement cycle, the limit, the due date and the balance you are carrying. The card number itself is not part of that and has no field to go in.
Where is my data stored, and is it encrypted?
On Google Cloud and Firebase infrastructure, encrypted in transit and at rest. That infrastructure carries ISO 27001 and SOC 2 certification from Google, and the application layer on top of it has been independently penetration tested.
Can other people see my accounts?
Only what you deliberately share, only with the person you share it with, and only as a read-only mirror of a balance rather than access to your ledger. Either side can revoke at any time.

Keep reading

The rest of the picture

Judge it on what it holds

A finance app that never collects your bank credentials is protecting you in the one way that cannot fail. Everything else is a promise; that part is structural.

Android and iPhone. No bank login. No ads. Message reading is optional and off until you switch it on.