How Wealth Forms Protects Client Data
Client forms carry Social Security numbers, account numbers and family details. This page explains how Wealth Forms handles them.
Opening a Form
- Unique links. Every form link belongs to one client and one form.
- A one-time code every time. Before a form opens, a Secure Form Code is sent to the client by email or text. It expires in 10 minutes, works once and is stored encrypted.
- Sessions stay with the device. An open form session is tied to the client's connection, so forwarding the link doesn't hand someone an open form.
- Expiring links. Links stop working when they expire or once the form is submitted.
Protecting Answers
- Encrypted in storage. Form answers are encrypted in the database.
- Masked on screen. Sensitive values like Social Security numbers are masked by default.
- Cleared after use. When an advisor applies a form to the client's record, the sensitive answers are cleared from the form.
- Encrypted in transit. Every page is served over HTTPS.
People Stay in Control
- Advisor review. A submitted form never overwrites a client record by itself. An advisor reviews each change and applies it.
- Audit logging. Exporting a Social Security number or other sensitive value to a PDF is recorded in the firm's audit log.
- Firm separation. Each firm's forms, answers and sending reputation are kept separate from every other firm's.
E-Signatures
Before signing, a client agrees to sign electronically. The exact consent text they saw is versioned and recorded.
When they sign, Wealth Forms saves an evidence record with the form:
- how they proved who they were, and where the code was sent (masked)
- when they consented and when they signed
- their IP address and browser
- a SHA-256 fingerprint of the form's exact content and answers
If anything in the form changes after signing, the fingerprint no longer matches. A signed PDF is created and kept with the client's record.
Email Safety
Form emails come from the advisor's firm name, from wealthforms.com or the firm's own domain. Wealth Forms never asks clients for passwords, payment or their code by phone or email. See how clients can check an email is real.
Reporting a Problem
Found a vulnerability, or got a suspicious email that claims to be from Wealth Forms? Email security@wealthforms.com, or see how to report a suspicious email. Compliance teams with questions about Wealth Forms can use the same address.