What Worthune stores, and what it never holds
Worthune stores what the planning engine needs and nothing more: accounts with balances and tax types, income and spending, debts, and members as birth years and relationships. It never holds holdings, transactions, custodian credentials, names, addresses or government identifiers. Every write is logged, and an organization's data is purged when it leaves.
Last reviewed . For the exact calls behind each step, see the developer docs.
What is stored
A household is a label your team chooses, an advisor reference, and the financial facts the engine reads: accounts by tax type with a balance and a total cost basis, income and expense streams, liabilities, and members described by a birth year, a relationship and, optionally, sex for longevity tables. Alongside it, the projections and decisions made on it, each with its record.
What is never held
Individual holdings and transactions stay with your custodian and portfolio system. Names, addresses, account numbers and government identifiers are not part of the record at all. Worthune holds no custodian or CRM credentials and connects to neither.
Who can see it
Every request is tied to your organization's key, and keys carry a role: viewer, developer or owner. Every change is written to an audit log your owner key can export. Our own staff do not read customer households in the course of normal operation.
When it is deleted
Archiving a household keeps it for its records. Leaving purges an organization's households, decisions and settings; the audit trail is kept. A free sandbox is purged automatically after its key has expired. The data-retention page states every window.
Questions
Common questions
- Do you support firms outside the United States?
- Worthune is built for United States households and is hosted in the United States. Its models apply US federal and state rules, and we do not currently support customers or client households outside the US. If you are outside the US, write to support@worthune.com before you buy.
- Is the data encrypted?
- In transit and at rest, through the hosting provider's standard encryption. Because the record carries no names or identifiers, there is nothing that needs field-level encryption; the due-diligence page says exactly what is and is not in place.
- Where is the data hosted?
- In the United States. Other regions are a decision we will make with the first customer who needs one.
Something not covered here? Write to support@worthune.com.