Your data stays yours.
You're trusting Formation with the whole picture. We treat that the way we treat every number on the screen — read-only, encrypted, and provable.
You're always in control
Formation is read-only by design. We can never move money, place a trade, or authorize a transfer. A lens on your wealth — never a key to it.
Never sold. No ads. No AUM take.
Formation is funded by your subscription — not by advertisers, and not by a percentage of your assets. Your financial data is never sold, full stop.
Built to prove it
Every figure carries its provenance — sourced, computed, estimated, or stale — and you can click any number to see exactly where it came from.
The Formation difference
We show our work.
Trust shouldn't mean "take our word for it." Every figure Formation shows is annotated — sourced from a custodian, computed from your holdings, estimated, or stale — and a click opens the source. Daily automated tests verify those citations against live output. It's the same principle as the security model: don't ask to be trusted, make it checkable.
Read the methodologyUnder the hood
AES-256 at rest
Encrypted at rest in our database.
TLS 1.3 in transit
Every byte between you and Formation is encrypted on the wire.
Multi-factor auth
TOTP authenticator apps + SMS via Twilio Verify. WebAuthn passkeys on the way.
Read-only bank links
Plaid handles the connection — your credentials never touch our servers.
Hide accounts from AI
Flag any account as private and its data never enters AURA's context — enforced on the client and re-checked on the server.
Export or delete anytime
Full JSON/PDF export whenever you want; a 30-day soft-delete window, then permanent erasure.
Safe enough to see everything.
No charge for 7 days · Cancel anytime · Read-only — we never move money
If your advisor, CPA, or attorney uses Formation
Formation for Professionals lets a firm work across the households that grant it access. Here is exactly what that does and does not allow — enforced in the software, not promised in a policy.
The household grants, never the firm
A firm can ask for access by your email. Only you — the household owner — can approve it, from your own account. A firm can never add you to its book.
Read-only, structurally
No part of the professional surface writes to your data. A firm cannot change a balance, link an account, alter a document, or move money. It isn't a permission we grant; there is no code path.
What you hide stays hidden
Accounts any household member hides from AURA are withheld from your firm too. Your firm is told only how many were withheld, never what they were.
Revoke without asking anyone
One click in Household → Professionals ends access at the next request. Your firm keeps its own meeting notes; it loses every dashboard immediately.
You can see who looked
Every access decision and every dashboard your firm opens is written to an append-only log that you can read — not your firm, and not us, deciding what to show you.
Asking isn't finding out
A firm requesting access by email gets the same answer whether or not that address has a Formation household. The product can't be used to discover who banks here.
Formation is software, not an adviser. Formation Money LLC is not a registered investment adviser and gives no personalized investment advice — the professional using it is the adviser, and they work for you.
Full detail in our Information Security Policy, Privacy Policy, and Data Retention Policy.