How Wealthfront Keeps Your Savings & Data Safe

Your trust is Wealthfront’s top priority, and we work around the clock—with internal teams and external partners—and strictly adhere to the rules set by our regulators to ensure the security of your accounts and the privacy of your data. 

At a glance:

• Federal Deposit Insurance Corporation (FDIC) insurance: Cash in your Cash Account is protected by up to $8 million of FDIC insurance through program banks ($16 million for joint accounts)
• Securities Investor Protector Corporation (SIPC) coverage: Your investments are protected by up to $500,000 of SIPC insurance
• Fraud monitoring: We actively monitor for suspicious activity and have trained experts on staff who specialize in the prevention of financial crimes and money laundering 
• Security practices: Our dedicated internal security team and external partners work together to anticipate, evaluate, and respond to potential risks
• Privacy policy: We never rent, sell, or trade your personal data to anyone for any reason

Read on for more details, plus some tips on additional measures you can take to further protect your online security. 

How your cash and investments are protected at Wealthfront

Cash in your Cash Account is protected by FDIC insurance through program banks up to $8 million ($16 million for joint accounts)

The FDIC insures cash deposits at banks to protect customers’ money in the event that a bank goes out of business. Wealthfront isn’t a bank, but we work with partner banks so we can make sure you’re covered by FDIC insurance. Generally, you can receive up to $250,000 in coverage for a given account at any given bank. At Wealthfront, we help you get more coverage. When you deposit money to a Wealthfront Cash Account, we send those deposits to multiple program banks so you get up to $8 million of FDIC insurance for your cash deposits ($16 million for joint accounts).

Your investments at Wealthfront are protected by SIPC coverage

When you invest with Wealthfront, your investments are protected by up to $500,000 of SIPC coverage, $250,000 of which can be in cash. SIPC oversees the liquidation of firms that close when the firm is bankrupt or in financial trouble, and customer assets are missing.

There are two things to know about SIPC coverage:

1. It’s unlikely you’ll need it. Because of the financial safeguards required by regulators, it’s quite rare for a brokerage to go out of business and for client assets to go missing. It’s only in this highly unusual situation that investor assets are missing that SIPC coverage even comes into play. Still, the coverage can provide some peace of mind. 
2. Market losses are not covered. SIPC coverage does not protect against market losses. The risk of your investments declining in value is just part of investing—that risk is why investing has the potential to earn higher returns than cash.

It’s worth noting that SIPC coverage also applies to money in transit at Wealthfront, including Cash Account deposits that are en route to a program bank. 

How Wealthfront protects you from fraud

We monitor for unusual account activity across all of your accounts

Our systems look for unusual behavior related to transactions and linked accounts, and automatically escalate it to our team for human review when necessary. We have trained experts on staff who specialize in the prevention of financial crimes and money laundering.

There are additional fraud-prevention features available for the Cash Account

• You can lock and unlock your Wealthfront Cash Account debit card right from the Wealthfront app or on the website. This can help prevent unauthorized purchases and withdrawals if you temporarily misplace your card.
• We’ll put a hold on your checking features if we suspect anything fraudulent to help prevent unwanted transactions. You can typically lift this restriction in minutes in the Wealthfront app. 
• We are PCI DSS-compliant. The Payment Card Industry Data Security Standard (PCI DSS) is a set of best practices designed to help make card (including debit card) transactions as secure as possible and to protect cardholder data. You can read more here.

How Wealthfront protects your security

We require two-factor authentication

Two-factor authentication helps protect your account by requiring two methods of verification when you log in. We require this for Wealthfront accounts. 

For our employees, we take this a step further. We require employees to use phishing-resistant factors for authentication for all systems that support it. 

We enable app-specific passwords

We know many clients want to link their Wealthfront accounts to external services like TurboTax, YNAB, and Monarch. However, if you use two-factor verification with Wealthfront, then you can’t use your Wealthfront credentials for this. App-specific passwords let you securely link to Wealthfront without using your Wealthfront password so the linked application has read-only access.

We encrypt your information

Wealthfront uses industry-standard cryptographic protocols to encrypt all client data. This includes document uploads, personally identifiable information, and sensitive information like your password. 

We conduct dark-web scanning for employee credentials

This dark-web scanning helps ensure that if employee passwords or emails are compromised, we know about it and can act quickly. We also conduct regular employee phishing exercises to help prevent employee credentials becoming compromised in the first place, and hold annual employee security training.

We follow best practices for least privilege

We follow the principle of least privilege. This means we only grant employees access and permissions to systems that are absolutely necessary. This helps minimize the potential for an attacker to gain access to information they shouldn’t have.

We also limit the data available to third-party applications like marketing platforms for the same reason, and only share the bare minimum required. In the event that we do share client data with a vendor, it is anonymized whenever possible. Vendors with client data are regularly reviewed by our third-party risk management committee, and we also review their security audit reports on a regular basis. 

We have an internal security team and engage external firms to test and validate our controls

Our internal team evaluates risks across our company and platform and institutes solutions when gaps are identified. They actively monitor security resources and review vendor security notifications for newly discovered vulnerabilities. We also work with external security firms to complement our internal security program. These relationships help us incorporate the latest in industry best practices. On top of that, a large, big-four accounting firm conducts an annual audit of our policies, processes, and procedures related to changes, privileged access, and our broker-dealer operations.

We are ISO 27001:2022-certified

The ISO 27001:2022 certification is a set of requirements for information security management systems that is broadly respected within the industry. This certification requires a wide range of robust security practices, including detailed business continuity planning, granular access control protocols, and a comprehensive incident management framework designed to protect our users’ assets.

How Wealthfront’s privacy policy protects your data

We don’t rent, sell, or trade your personal information to anyone for any reason

Your data belongs to you, so our approach to it is simple: We don’t rent, sell, or trade it. You can read more details in our privacy policy. 

What you can do to further protect yourself

We think it’s smart to take an active role in protecting your accounts and data, too—not just at Wealthfront, but everywhere. Here are some tips for maintaining good online security in general.

• Use two-factor authentication everywhere you can, not just at Wealthfront. If you have the choice, consider using an authenticator app (like Google Authenticator or 1password) as your second factor instead of SMS. Hard tokens are also a good alternative to SMS as a second factor.
• Choose strong passwords and consider using a password manager. Best practice is to make your passwords at least 16 characters long. You should avoid reusing passwords, and consider using a password manager like 1password or bitwarden (which is free) to keep your passwords straight.
• Use app-specific passwords whenever possible. They can provide a valuable layer of protection when you’re sharing access or information with a third party.
• Keep an eye on your account activity. If you see something odd in any of your accounts, contact the relevant institution.
• Keep your phone, computer, and web browser up to date. Many software updates contain important security fixes. Don’t miss out! 
• Avoid suspicious links, phone calls, web sites, and text messages: Reach out to support if you get something from Wealthfront you aren’t sure of. Make sure you are logging in to wealthfront.com instead of another website by mistake (and avoid following sponsored links in search results and social media links to log in to your account). And remember: We will never ask for your password over the phone or by email.

Thank you for placing your trust in us. We work hard to protect your accounts and data, and we hope you’ll take the steps above to help keep your online accounts even more secure.