Security

How we keep bank connections and personal information safe.

You connect through a bank aggregator. We encrypt that connection, keep the wrap key out of the database, and keep names and emails off your money records.

We never take your bank password

When you connect an account, you sign in through a bank aggregator. We use Plaid. Many banks send you to their own login page. Watchtower does not see that password and does not store it. Plaid confirms it is you. We use the connection afterward to show balances and transactions.

The bank connection is encrypted

After you connect, Plaid gives our servers a token so we can refresh your accounts. That token is encrypted before it is saved. The wrapping key is not stored in the same database. In production that wrap is Google Cloud KMS: the application can encrypt and decrypt, and it cannot export the key. The token never goes to your browser. It is not written to logs. A stolen copy of the database would not contain a usable bank connection.

Names and emails stay off the money records

We keep an email so you can sign in and invite someone to a household. We do not copy names, emails, or phone numbers onto transactions, budgets, or account rows. We do not sell your financial data. We do not offer support tools for looking up your financial data.

Your household stays yours

Watchtower is a private household product, not a social feed. The server only serves financial data for the household you belong to. Hiding a page in the app is not how that is enforced.

We store what we need for budgeting

Connected accounts, balances, transactions (including the original bank line), categories, and budgets. We do not keep extra raw exports just in case. If language models help with wording, we avoid sending unnecessary raw financial detail.

Where financial data lives

Production runs on Google Cloud and Vercel.

The site and signed-in app are hosted on Vercel. The API and database are hosted on Google Cloud. We chose that split so the database can stay off the public internet, and so wrapping keys are used rather than copied into an environment variable.

Private database: Production Postgres lives on Cloud SQL with no public IP. The API reaches it on a private network.
Keys stay in KMS: Bank-connection wrap uses Cloud KMS. Secrets the app needs (sign-in, Plaid, mail) sit in Secret Manager, not next to your financial data.
Split hosts: Vercel serves the marketing site and signed-in app. Cloud Run serves the API. The API does not run on the same host as the pages you browse.

Watchtower is operated by Watchtower Money, LLC. Legal terms are in our Terms and Privacy policy. Security questions: security@watchtower.money.