Security & on-device design

Product: Money Compass (The FinCoachHub Ltd)

URL (publish to): https://www.thefincoachhub.com/security

Version: 2026-09-27-SOFT-BETA

Status: Soft beta — solicitor / security review pending. Not a penetration-test certificate.

Design principles

1. Local-first vault — statements and habit state live in on-device encrypted SQLite (SQLCipher).
2. On-device coaching — Monet uses an on-device SLM where shipped; voice stays on device.
3. Minimise cloud — partner attribution and sanitised milestones only when product flows require them.
4. No raw statement dumps to portal — brokers see Match Codes and sanitised pings, not your PDF vault.
5. Human gates on regulated routing — compliance assistants help people; they do not fully auto-route intros without verified firm seat + disclosure log.

What brokers receive

Sanitised readiness / milestone signals and handoff summaries you consent to share — not merchant-level feeds or balance exports.

What we are still building toward

For national networks we expect stronger assurance over time (e.g. SOC 2, pen test, DPA pack). We are not claiming ISO 27001 or SOC 2 today. Solicitor review is required before national-network claims.

Report a vulnerability

Email security@thefincoachhub.com. Please exclude raw bank statements from reports; describe the issue and steps to reproduce with dummy data.