Encrypted in transit and at rest
TLS everywhere; encrypted at rest; nothing self-hosted to leave unpatched.
Security & compliance
Guardrails are code, not policy.
Built so it cannot do what we are not licensed to do — and so everything it does is reconstructable.
Our mission
- We believe you should be able to ask any financial question without becoming someone's data.
- We believe understanding a product should never cost you your privacy.
- We believe your financial information reaches a participating, licensed partner only when you authorize it.
That's why we built DuckWater: a private place to learn, compare and navigate financial products on your own terms.
Create your private accountLearn first. Share only when you choose to.
Controls
What protects your information
Roles resolve on the server, every request
Hiding a button is not access control.
Contractors see status, never the file
Enforced in the queries — the fields are not in the projection a partner can read.
Every action is an event
Who, what, when — on every change. Bulk actions undo, and the undo is an event.
Codes and links expire
Single-use, time-bound codes. Nothing sensitive in a URL, log or email.
Abuse controls on every public route
Caps, honeypots and throttles on every public route.
The boundary
What DuckWater will not do
Not aspirations — lines the software cannot cross.
- Never lends, never influences a credit decision.
- Never sells or binds insurance.
- Never holds funds or digital assets.
- Never checks your credit — the partner explains its own inquiry first.
- Routing picks the reviewer, never the answer.
- Neutral order on anything secured by a home.
What we are, and what we are not — Licenses & disclosures. What happens to your data, in seven disclosures — Data protection & encryption.