How CrestCast Protects Your Financial Data

A household forecast only works if you're honest with it, and that means real salary, real mortgage balance, real debts. So the app is holding some of the most sensitive numbers in your life. Here is exactly what happens to that data.

Stored privately, isolated per user

Your data lives in a Postgres database on Supabase, protected by strict per-user access controls. Row-Level Security is enforced at the database itself and tied to your authenticated account, so every read and write is checked against your own user ID. In practice that means no other user can reach your data by accident. It is encrypted in transit (TLS) whenever it moves between your device and our servers, and encrypted at rest (AES-256) on the underlying storage.

Built on an independently audited platform

We don't run our own data centre. CrestCast is hosted on Supabase, an established cloud platform that is SOC 2 Type 2 compliant and ISO 27001 certified. Those are the storage, encryption and authentication foundations your forecast sits on, held to standards that are independently audited. Row-Level Security, enforced inside Postgres itself, is what isolates your data to your own account on top of that platform.

What that rules out

• No bank connections and no payment credentials stored, ever
• Your financial data is never used for advertising or profiling
• Your financial data is never sold or handed to third parties; the only people who can see it are you, and a partner you deliberately choose to share a household with
• You can delete your account and all of your data whenever you want, with a short window to change your mind before it goes

Why this matters more for a joint household model

Because CrestCast is designed so both partners can see the whole plan, it necessarily holds a complete picture of a household's finances in one place, with combined income, joint bills and shared debts all together. That concentration of sensitive data is exactly why per-user isolation and delete-anytime control matter.

Seeing and changing are separate permissions, too. The account holder chooses whether a partner's access is viewing or viewing and editing; a new invite starts with viewing, where every shared number and chart is theirs to read, their own details stay theirs to edit, and nothing they tap can change the shared plan. That is enforced by the database refusing the write, not by hiding a button, so it holds whatever screen the request comes from.

The short version: you get a cloud-synced forecast that both partners can see, and update at the level you set, stored privately behind per-user access controls, and deletable in full whenever you want, with a short window to change your mind before it goes.

For a look at the actual forecast output this protection is around, see "Should I Upsize My Home?" or any of the other scenario-comparison posts on this blog.