Security
The platform is private by default: the app sits behind authentication, and saved work is isolated per workspace at the database layer.
Account and access
Every workspace sits behind authenticated sign-in. Sessions are managed server-side in httpOnly cookies — credentials and tokens are never stored in browser-accessible storage. Public pages like this one contain no user data.
Data isolation
Saved watchlists, comparisons, portfolios, and model scenarios are scoped to your workspace and enforced with database row-level security — authorization happens at the data layer, not just in the interface. Administrative credentials never reach the browser.
De-identified by design
Alca Wealth is built to work without client personal information. Saved portfolios use anonymous labels; the platform does not store client names, account numbers, government IDs, custodian credentials, statements, or tax documents.
Auditability
Create, update, and delete actions on saved work are recorded in an audit log scoped to your workspace.