Security

Journey handles compensation, benefits, equity, and financial data. Protecting it is a design constraint, not a feature. This page describes how, in plain terms.

Infrastructure

Journey’s product runs on cloud infrastructure including Vercel, Supabase, and Amazon Web Services. Our marketing site is served through Cloudflare and uses separate data stores and access boundaries from the product.

Encryption

Data is encrypted in transit and at rest.

Access controls

Access to Journey is protected through secure authentication and role-based access controls. Internal access to customer information is limited by least-privilege principles and operational need. Administrative access is protected by multi-factor authentication and logged.

Data boundaries

The employer–employee data boundary — what your employer can and cannot see — is defined precisely in our Privacy Policy. It is enforced in the product’s architecture, not just in policy.

Financial account connections are read-only. Journey retrieves account details, balances, transactions, investments, and liabilities. Payment and money-movement products are not enabled, and Journey cannot move money through these connections. Connections are handled by established financial-data aggregation providers, each listed with links to their security practices on our Subprocessors page.

You can also connect your own equity accounts, such as Carta. These connections are read-only: Journey retrieves your equity records and cannot transact.

Your employer’s HR, payroll, and equity systems connect through established integration providers, authorized by your employer, with read-only access.

AI and data

Journey uses third-party AI model providers under contracts restricting their use of your data. We do not permit them to train their models on your data.

Reliability and recovery

Journey maintains backups and recovery procedures designed to protect against accidental loss or service disruption.

Reporting a vulnerability

If you believe you’ve found a security issue, email security@usejourneywealth.com. We take security reports seriously and investigate reported issues promptly.

Questions

Security reviews are welcome. Employers evaluating Journey can reach us at security@usejourneywealth.com.