Your statements are personal. We treat them that way.
Here is exactly what Wealth Plus can and cannot do with your information, in plain words.
Read-only, always
Wealth Plus has no connection to your broker, bank or fund house. It cannot place orders, move money or change your accounts. It only reads statements you give it.
No broker or bank passwords
We never ask for them. You upload the contract notes and statements your broker already sends you.
PDF passwords used once
Contract notes are opened with your PAN and date of birth at the moment of upload. The password itself is never saved.
Stored in India
Your data is kept on servers located in India, backed up every day, with backups encrypted.
Encrypted in transit and at rest
Every page is served over HTTPS. Databases and backups are encrypted on disk.
Sign-in code by email
A one-time code sent to your email at sign-in. Always on for advisor staff; families can turn it on under Account > Sign-in security.
A log of every sign-in and change
See when your account was used, from where, and what changed. The log itself cannot be edited.
You can leave with your data
Download your reports in Excel or PDF, and export your trades in a file you can upload elsewhere, at any time. Ask us to close your account and your data is removed, apart from billing records the law requires us to keep.
Who can see your data
You, and the people you give a login to. If you use Wealth Plus through your advisor or CA, their office can see the families they manage, and no one else's.
Our support team looks at your account only when you ask for help, and every such access is logged.
What we never do
- Sell or rent your data
- Show you ads based on your holdings
- Give investment tips or push products
- Share your data with anyone without your consent, unless the law requires it
Privacy laws we follow
Wealth Plus is run from India and follows India's Digital Personal Data Protection Act, 2023. As we open to users in the UK and Europe, we will handle their personal data in line with the UK GDPR and the EU GDPR, including your rights to see, correct, export and delete your data. Details are in the privacy policy.
Analytics cookies are used only if you allow them. Cookie settings
How this website is protected
This site and the app are tested against the OWASP Top 10, and the findings fixed before release.
HTTPS everywhere
TLS 1.2 or newer only, with HSTS so browsers never fall back to plain HTTP.
Strict browser rules
A content security policy that blocks scripts from unknown sites, and the pages cannot be framed by another site.
Payments by Razorpay
Card, UPI and bank details go straight to Razorpay. We only receive the payment reference, and check its signature before marking it paid.
Forms guarded
Every form is protected against forged requests, bots and repeated submissions.
Found a security problem?
Email [email protected] with the subject "Security". We reply within two working days and keep you updated until it's fixed. Our contact details for researchers are also in security.txt.
Please don't run automated scans against the live app, access other people's data or disrupt the service while testing.