How we keep your account safe

• Your password is handled by our sign-in provider, Supabase. NestWise never sees it or keeps a copy of it.
• Before you share something, invite someone, send information to an adviser or download a full copy of your data, we ask you to confirm your email address with a six-digit code. The code works once, expires after 15 minutes, and stops working after five wrong tries.
• If you change your email address, we ask you to confirm the new one the same way.
• Codes and confirmation links are sent only to you.
• Everyone at NestWise who can open our admin area signs in with two-step sign-in: a password plus a code from an authenticator app.

Everything you keep in NestWise stays here in Australia, locked with the same standard of encryption banks use — while it rests with us, and every time it travels to your phone or computer.

We also take a fresh copy of your family’s records every day and keep the last week of them, so a bad day never means starting again. The scans and documents you upload are just as protected, locked away in their own private vault.

A few supporting services, such as payments and email delivery, run overseas. We list every one of them, and where it runs, on our data residency page.

NestWise will never ask you, by phone, email or text, to:

• tell us your password or a sign-in code
• move money or make a payment to anyone
• install software or give anyone remote access to your device

If a message that looks like it’s from us asks for any of these, don’t reply or click its links. Forward it to hello@nestwise.net.au. Use a password for NestWise that you don’t use anywhere else.

Please email hello@nestwise.net.au with “Security” in the subject. Tell us what you found and how to see it. We read every report and will keep you updated.

Please use only your own account while looking, don’t access or change other people’s information, and don’t test the systems of the services we use.