A complete view of your money is worth protecting properly.
Highwater holds the most sensitive picture of your finances you are ever likely to assemble. These are the commitments we design around, in plain terms.
Read-only by design
Every account connection is read-only. Highwater can read balances, transactions and positions; it has no payment-initiation capability anywhere in the product, so there is no code path that could move your money.
Passkeys, not passwords
Sign in with the biometrics already on your device. The credential never leaves your hardware, so there is no shared secret to phish, reuse or leak in someone else's breach.
Encrypted in transit and at rest
TLS on every request, encryption at rest in a managed Postgres database, and row-level isolation so one household's data is never reachable from another's session.
Privacy mode
One keystroke masks every balance, salary and grant while leaving the structure of the page visible. Useful in an open-plan office, or on a train.
Your data is not the product
Highwater is paid for by subscriptions. We do not sell, rent or broker your data, and we do not run advertising or lead-generation against it. There is no second revenue line to protect you from.
Export and deletion
Export your full dataset whenever you want it. Disconnect a feed and the link is revoked; delete your account and the records go with it, including the derived snapshots.
Infrastructure
Managed European hosting and a managed Postgres database, with automated backups and monitored error reporting.
Certification
Highwater is in early access and not yet independently certified. We will publish the audit when it is done rather than imply it beforehand.
Reporting an issue
Write to security@highwaterapp.com and a person will read it and reply.