Your privacy is our top priority.
We built CashCurve so your financial data stays private by default. Here's exactly what we do to protect it.
AES-256-GCM uploads · primary AWS Sydney deployment · provider handling disclosed
Every document is encrypted on upload
Uploaded files are encrypted with AES-256-GCM in storage. Content is decrypted for AI processing. Response settings, files, caches and tracing have separate provider controls; no universal retention or training guarantee is made.
Uploaded originals removed within 7 days
Uploaded originals are removed from active file storage within seven days of upload and may be removed sooner. Extracted facts remain. Provider and recovery copies have separate limits.
Selected direct identifiers are encrypted
Selected direct identifiers are encrypted before database storage. Financial amounts, descriptions and account-linked operational rows can still identify people. Encryption does not make the household anonymous.
Authorised staff access is controlled
Authorised staff can access financial descriptions and operational records to operate the service. Staff access requires release verification and is not a promise that the team cannot identify you.
AI provider handling has separate controls
Provider training, retention, processing location and historical copies require channel-specific evidence. A response storage flag does not prove universal zero retention. See our Privacy Policy.
Primary deployment targets Australia
The primary application deployment targets AWS Sydney. AI, authentication, hosting/CDN, delivery, monitoring, speech and recovery services may process data outside Australia; deployed locations require verification.
You own your data. Delete it anytime.
You can request account deletion through the account controls. File cleanup, recovery copies and restricted operational liability records have separate limits described in our Privacy Policy.
No data selling. Ever.
We don't sell, rent, or share your personal data with advertisers or data brokers. There are no ad integrations. Your privacy isn't a revenue source. It's a design principle.
Under the hood
Envelope encryption
Encrypted fields and uploads use envelope encryption with wrapped data keys. Access to decryption keys and authorised application paths still needs protection.
Blind indexes for lookups
Blind indexes support exact account lookups. Authorised administrative search and financial descriptions have separate access controls and can identify an account.
Encrypted at rest and in transit
Uploads and selected fields have application encryption. Transport, infrastructure backups and caches require deployed configuration verification; this is not an all-channel encryption guarantee.
Incident response plan
Documented incident procedures and bounded technical diagnostics support investigation. Continuous observation of every failure is not guaranteed.
How the AI is governed
Provider training, retention and processing location need channel-specific verification
Uploaded originals leave active storage within 7 days; provider and recovery copies are separate
Code performs financial calculations. AI can make mistakes when extracting or explaining information, so verify important results
For full details, read our Privacy Policy.
Questions about security? Contact us at support@cashcurve.ai