Whistl Security & Compliance: Enterprise-Grade Financial Protection

Your financial data deserves enterprise-grade protection. Whistl uses AES-256-GCM encryption, chain-hashed SHA-256 audit logging, biometric authentication, and SOC 2 compliant infrastructure to protect your most sensitive information.

Encryption & Data Protection

• AES-256-GCM: Military-grade encryption for all stored data
• SecureConfigProvider: Firebase Remote Config + Keychain fallback for API keys
• Firestore Security Rules: Row-level access control
• Listener lifecycle management: Proper cleanup prevents data leaks

Audit Logging

• Chain-hashed SHA-256: Tamper-proof audit trail
• Every action logged: Blocks, bypasses, savings, configuration changes
• Immutable records: Each log entry includes hash of previous entry
• Exportable: Users can download their complete audit history

Authentication

• Firebase Auth: Industry-standard authentication
• Biometric step-up: Face ID/Touch ID for sensitive actions
• 5-minute timeout: Biometric auth expires after 5 minutes
• Multi-factor ready: SMS/email 2FA available

Compliance

• KYC verification: Know Your Customer for investment features
• AML detection: Anti-Money Laundering monitoring
• Privacy by design: Data minimization, purpose limitation
• GDPR/APP compliant: Right to access, right to deletion

Conclusion

Whistl's security infrastructure matches the sensitivity of your financial data. Enterprise-grade encryption, tamper-proof audit logs, and biometric authentication—your data is protected at every level.

Related: Privacy Policy | Terms of Use