Skip to main content
Security & privacy

Your data stays yours.

You're trusting Formation with the whole picture. We treat that the way we treat every number on the screen — read-only, encrypted, and provable.

Read-only

You're always in control

Formation is read-only by design. We can never move money, place a trade, or authorize a transfer. A lens on your wealth — never a key to it.

Never sold

Never sold. No ads. No AUM take.

Formation is funded by your subscription — not by advertisers, and not by a percentage of your assets. Your financial data is never sold, full stop.

Provenance

Built to prove it

Every figure carries its provenance — sourced, computed, estimated, or stale — and you can click any number to see exactly where it came from.

The Formation difference

We show our work.

Trust shouldn't mean "take our word for it." Every figure Formation shows is annotated — sourced from a custodian, computed from your holdings, estimated, or stale — and a click opens the source. Daily automated tests verify those citations against live output. It's the same principle as the security model: don't ask to be trusted, make it checkable.

Read the methodology
The shipped feature, captured live from the demo's sample household.
Specifications

Under the hood

AES-256 at rest

Encrypted at rest in our database.

TLS 1.3 in transit

Every byte between you and Formation is encrypted on the wire.

Multi-factor auth

TOTP authenticator apps + SMS via Twilio Verify. WebAuthn passkeys on the way.

Read-only bank links

Plaid handles the connection — your credentials never touch our servers.

Hide accounts from AI

Flag any account as private and its data never enters AURA's context — enforced on the client and re-checked on the server.

Export or delete anytime

Full JSON/PDF export whenever you want; a 30-day soft-delete window, then permanent erasure.

Safe enough to see everything.

No charge for 7 days · Cancel anytime · Read-only — we never move money

For professional firms

If your advisor, CPA, or attorney uses Formation

Formation for Professionals lets a firm work across the households that grant it access. Here is exactly what that does and does not allow — enforced in the software, not promised in a policy.

The household grants, never the firm

A firm can ask for access by your email. Only you — the household owner — can approve it, from your own account. A firm can never add you to its book.

Read-only, structurally

No part of the professional surface writes to your data. A firm cannot change a balance, link an account, alter a document, or move money. It isn't a permission we grant; there is no code path.

What you hide stays hidden

Accounts any household member hides from AURA are withheld from your firm too. Your firm is told only how many were withheld, never what they were.

Revoke without asking anyone

One click in Household → Professionals ends access at the next request. Your firm keeps its own meeting notes; it loses every dashboard immediately.

You can see who looked

Every access decision and every dashboard your firm opens is written to an append-only log that you can read — not your firm, and not us, deciding what to show you.

Asking isn't finding out

A firm requesting access by email gets the same answer whether or not that address has a Formation household. The product can't be used to discover who banks here.

Formation is software, not an adviser. Formation Money LLC is not a registered investment adviser and gives no personalized investment advice — the professional using it is the adviser, and they work for you.

TLS 1.3AES-256MFA

Full detail in our Information Security Policy, Privacy Policy, and Data Retention Policy.

Formation Money provides financial planning software and educational content, not personalized investment, legal, or tax advice. Formation Money is not a registered investment adviser. For personalized guidance, work with your own CPA or a licensed financial adviser.

How we compute and cite every number →

© 2026 Formation Money LLC. All rights reserved.