Security at Advizmo
🔐 Bank-Level Security Standards
Advizmo encrypts data in transit using TLS 1.3 and at rest using AES-256. Our infrastructure runs on Amazon Web Services (AWS), which maintains certifications including SOC 2 Type II, PCI DSS Level 1, and ISO 27001 for the underlying cloud infrastructure. Advizmo implements application and data layer controls under the AWS Shared Responsibility Model.
🏦 Your Banking Credentials Stay Private
Your banking login information is never viewed or stored by Advizmo. We use specialized financial data integration services with OAuth connections when possible, allowing you to authenticate directly with your bank without sharing credentials.
🔒 Complete Data Encryption
All financial data is encrypted both in transit (using TLS 1.3) and at rest in our database (using AES-256 encryption). Your information remains protected even if storage hardware is compromised.
📊 Data Minimization Principle
We collect only the transaction and account information needed to provide our services. Bank login credentials are never viewed or stored by Advizmo, and are not requested or stored through the authentication process. Personal information we do collect, including information required to open a brokerage account, is described in our Privacy Policy.
🗑️ Complete Data Control
You can request deletion of your platform data at any time from the mobile app settings or by contacting support. Investment advisory records are retained for at least five years as required by SEC rules and are not deleted on request.
Detailed Security Framework
Below you’ll find comprehensive details about our security practices, data handling protocols, and technical infrastructure.
Your Data, Your Control
Transparency in Data Handling
Advizmo’s team operates under strict data access protocols. Our team members do not access your personal financial information during routine operations. Access to customer data is limited to these specific scenarios:
When you explicitly request assistance requiring data access
In compliance with legal requirements
Each instance of data access follows our strict protocol:
Implementation of multi-level permission controls
Comprehensive access logging including purpose, duration, and authorization details
Required customer consent except where legally prohibited
Violations of these protocols may result in disciplinary action up to and including termination.
For analytical purposes, we may study anonymized, aggregated data patterns to improve our services. See our Privacy Policy for complete details.
Robust Account Protection
Your Advizmo account is secured through multiple layers of protection:
Password security using advanced cryptographic techniques (salting and iterative hashing)
Intelligent rate limiting and monitoring systems to prevent unauthorized access attempts
Comprehensive password requirements including minimum length and complexity standards
Proactive screening against known vulnerable password databases
Comprehensive Data Safeguards
Your financial information benefits from enterprise-grade protection:
Full encryption of data in transit using TLS 1.3 and of stored data using AES-256 encryption standards
Secure data architecture ensuring information remains protected even if storage hardware is compromised
Platform data removal process upon account termination that purges associated platform information, subject to the advisory records retention requirements described below
True deletion of platform data rather than simply deactivating or archiving it
Account deletion requires your explicit action. If your subscription lapses, we follow the data retention policies detailed below.
Data Retention Framework
Data Management Options
You have full control over your data with two approaches:
Immediate deletion: You can request removal of your platform data at any time from the settings section of the mobile app or by emailing support@advizmo.com.
Default retention: After a subscription or trial period ends, we maintain platform account data for up to 12 months. This retention period enables account reactivation should you return to Advizmo.
Advisory records retention. Investment advisory records are handled differently. As an SEC-registered investment adviser, we are required to retain certain records for at least five years, and those records are not deleted on request. This includes advisory agreements, account opening documents, trade records, communications relating to investment recommendations, and fee billing records. See Section 5 of our Privacy Policy.
Subscription Status Clarification
When you cancel your subscription, your account remains fully functional until the end of your current billing cycle. The 12-month retention period begins only after this active period concludes.
You have the option of deleting your platform data at any time, including when you cancel your subscription or any time thereafter. Advisory records subject to SEC retention requirements are not deleted on request.
Our philosophy is straightforward: if you no longer need our services, we don’t need to retain your data beyond the specified periods. For comprehensive information on data handling practices, please review our Privacy Policy.
Technical Infrastructure
Cloud Security Architecture
Advizmo platform is built on Amazon Web Services (AWS). The underlying AWS cloud infrastructure holds independent third-party certifications, including SOC 2 Type II, PCI DSS Level 1, and ISO 27001. AWS publishes a complete list of its certifications and attestations at aws.amazon.com/compliance.
Advizmo itself is not separately certified under SOC 2, PCI DSS, ISO 27001, or HITRUST. Advizmo implements controls at the application and data layer under the AWS Shared Responsibility Model, including encryption, access controls, logging, and ongoing monitoring. We are working toward formal certification of our application-layer controls and will update this page when those certifications are completed.
We implement the AWS Shared Responsibility Model, where AWS secures the underlying infrastructure while Advizmo maintains responsibility for implementing appropriate security controls at the application and data levels. Advizmo conducts continuous monitoring designed to detect actual and attempted intrusions, and reviews its security controls at least annually.
All customer data resides in United States-based AWS data centers with comprehensive security measures including TLS 1.3 encryption for data in transit and AES-256 encryption for data at rest.
Written Information Security Program
As a financial institution under the Gramm-Leach-Bliley Act (GLBA), Advizmo maintains a written information security program (WISP) designed to protect the security, confidentiality, and integrity of customer information, in accordance with the FTC Safeguards Rule (16 CFR Part 314). Our WISP includes administrative, technical, and physical safeguards appropriate to the size and complexity of our business and the nature and scope of our activities.
A designated Qualified Individual is responsible for overseeing, implementing, and enforcing our WISP and reports periodically to senior management on the program status and any material matters.
The WISP maps each element required by the Safeguards Rule to the controlling provision of Advizmo’s Compliance Policies and Procedures Manual, and records the customer information inventory and the Qualified Individual’s annual report.
Payment Processing Security
Advizmo adheres to Payment Card Industry (PCI) security standards through our integration with PCI-certified payment processors. Our payment architecture routes sensitive payment information directly to our processor’s secure environment, bypassing Advizmo’s servers entirely. This approach significantly reduces potential exposure of payment details.
Secure Financial Connections
To enable the synchronized view of your financial accounts, we partner with Plaid Inc., which follows these security practices.
Credential Security: Your banking login information is never viewed or stored by Advizmo. Our integration partners employ specialized security infrastructure to protect this sensitive information.
Direct Authentication: Where supported, we implement OAuth connections allowing you to authenticate directly with your financial institution without sharing credentials with any intermediaries.
Data Minimization: Through our aggregation partner we collect only essential transaction and account information, such as dates, transaction descriptions, amounts, and balances. Bank login credentials are neither requested nor stored in our systems, including through the OAuth process. Personal information we collect directly, including information required to open a brokerage account, is described in our Privacy Policy.
Communication Security
All data exchanged between your devices and our platform is protected by TLS 1.3 with modern cipher suites.
TLS 1.3 protocol implementation for secure browser-server communications
AES-GCM cipher suites for data in transit under TLS 1.3
AES-256 encryption for data at rest
Content Security Policy implementation to prevent common web vulnerabilities
Beyond Technical Security
Awareness & Education
Even the most sophisticated security systems can be compromised through social engineering tactics. We recommend these security practices:
Remember that Advizmo team members will never initiate contact requesting your login credentials. Only enter your username and password on our official login page.
Always verify you’re on our authentic domain (advizmo.com) before entering any sensitive information. Check the URL in your browser’s address bar, especially when following email links.
Security Support
For any security concerns or questions, please contact our dedicated security team at security@advizmo.com. For more information about our data protection approach, please refer to our Privacy Policy.