A clear account of what protects your data today: an independently tested app, encryption in transit and at rest, and an architecture that never collects the credentials worth stealing in the first place.
Independent validation
Where NetWorth+ actually stands
In short
An independent penetration test has been completed, covering the full scope of the app, including how data is protected in transit and at rest, with no issues found. Data is encrypted in transit and at rest on Google Cloud and Firebase infrastructure, which carries ISO 27001 and SOC 2 certification from Google. The app has no open banking connection, collects no bank credential and cannot initiate a payment, so the material most worth stealing from a finance app is never present to steal. Bank alert SMS is read and parsed on the device and the message text is not uploaded. No full card number is ever stored, and sign-in runs on Firebase Authentication, so no password is stored by NetWorth+ at all. Access rules enforced on the server mean one account can only ever read its own records, rather than that restriction living in app code where a modified client could ignore it. Security reports go to support@networthplus.in and are read before feature work.
Data encryption
In transit & at rest
Third-party pen test
Completed, no issues found
Card numbers stored
None, ever
Passwords stored by us
None, Firebase Auth
Enterprise grade
This is the single most misused claim in finance app marketing, so it is worth separating carefully.
NetWorth+ runs on Google Cloud and Firebase, the enterprise platform behind regulated financial and healthcare workloads worldwide. It is independently certified to ISO 27001, ISO 27017, ISO 27018 and SOC 1, 2 and 3, audited annually by third parties, and operated from data centres with hardware-level security, continuous monitoring and strict physical access control.
Your ledger is encrypted twice over, and neither layer is optional. In transit, every connection runs over TLS, negotiated at TLS 1.3 with modern devices. At rest, your data is encrypted with AES-256, with keys held, managed and rotated inside Google’s key management infrastructure.
Every record is written to multiple independent zones, so the loss of a disk, a machine or an entire data centre does not lose your ledger. Auto-backup can be scheduled daily, weekly or monthly and export is available at any time.
Certified infrastructure says nothing on its own about the code running on top of it, which is why the NetWorth+ application was independently penetration tested across its full scope, including how data is protected in transit and at rest. The test found no issues.
Check by check
The list a due diligence reader works through, with our actual status against each line rather than a general reassurance.
| Independent check | Status today | What that means in practice |
|---|---|---|
| Third-party penetration test | Completed | An independent tester assessed the app across its full scope and found no issues. |
| Data encryption | In place | Data is encrypted in transit and at rest on Google Cloud and Firebase infrastructure. |
| Vulnerability disclosure route | In place | A published address, a commitment to read security mail first, and a request for a reasonable window before public disclosure. Detailed below. |
| Published security overview | This page | The written account of architecture, data handling and protections that a reviewer would otherwise have to request by email. |
| Infrastructure certification | Held by Google | ISO 27001 and SOC 2 apply to the Google Cloud and Firebase platform underneath the app. |
This table is updated whenever a new independent check is completed. Last updated August 2026 to reflect the penetration test above.
Threat model
The strongest security property an app can have is not holding the dangerous thing in the first place. Four decisions do most of the work here.
NetWorth+ never asks for a bank username, password or open banking token, and has no aggregator integration. A total compromise of our systems yields no way into anybody's bank account, because that material was never collected.
The app cannot move money. It has no payment capability to abuse, so the highest value attack against a finance app, initiating a transfer, does not exist against this one.
Bank alert messages are read and interpreted on your phone. The message text is not uploaded, so there is no server-side store of your SMS to breach. The feature is optional on Android, and off until you switch it on.
The restriction that an account can read only its own records lives in server-enforced access rules, not in app code. A modified or rebuilt client cannot argue its way past them, because it is not the client making the decision.
Blast radius
The useful question is not whether a breach is possible, it is what a successful one would actually be worth. Here is the honest inventory.
| Data | Reachable in a breach of our systems? |
|---|---|
| The ledger you built: accounts, balances, transactions, categories, budgets and goals | Yes. This is the substance of what NetWorth+ stores, and a breach would expose it. |
| Shared expense records and settlements with other people | Yes, for the records connected to the affected account. |
| The email address on your account | Yes. |
| Your bank username, password or any open banking token | No. None is ever collected, so none exists to take. |
| The content of your bank SMS messages | No. Message text is processed on the device and is not uploaded. |
| Your full credit or debit card number | No. NetWorth+ never stores a full card number. Card records in the app are the cycle, limit and due-date details you enter, not the card itself. |
| Your account password | No. Sign-in runs on Firebase Authentication and NetWorth+ stores no password. |
| The ability to move money out of any account | No. The app has no payment capability whatsoever. |
Stating this openly is deliberate. An app that will not tell you what a breach would expose is asking you to assume the answer is nothing, and it never is.
Responsible disclosure
A direct line to the team, not a ticket queue: a real address, a fast read, and credit where you want it.
Send the detail to support@networthplus.in with enough information to reproduce the issue. Security mail is read before feature work.
Please allow a reasonable period to investigate and ship a fix before disclosing publicly. We will tell you what we find rather than going quiet.
Use your own account and your own data. Do not access another person's records, degrade the service for others, or run destructive tests.
If you would like to be credited for the report once it is fixed, say so and you will be. If you would rather stay anonymous, that is fine too.
NetWorth+ has a narrow attack surface by design: no bank credentials collected, no payment capability, and per-user access rules enforced on the server. That design has been independently penetration tested across the app's full scope, with no issues found, and your data is encrypted in transit and at rest on Google Cloud and Firebase infrastructure.
Questions
Keep reading
A finance app that never collects your bank credentials is protecting you in the one way that cannot fail. Everything else is a promise; that part is structural.
Android and iPhone. No bank login. No ads. Message reading is optional and off until you switch it on.