Encryption at rest and in transit
All data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest on AWS infrastructure. Encryption keys are managed by AWS, separately from the data they protect.
Privacy & security
Your data is private. Deliberately, and by design.
Steward is built for families with assets worth protecting. That means the security model is not an afterthought; it is the architecture. This page explains how your data is stored, who can access it, and what we do with it.
How we protect your data
Security is a layered commitment, from the infrastructure your data lives on to the access controls that determine who can see it.
Proven cloud infrastructure
Steward runs on Amazon Web Services, which maintains SOC 2 Type II, ISO 27001, and PCI DSS compliance across the infrastructure we build on.
Access control you define
You decide who sees what. Grant advisors, family members, or successors a scoped view of your data, and revoke access at any time. An advisory firm is read-only unless you ask for more: you can let one add documents to the folder you share with them, and nothing beyond it.
Document vault isolation
Vault documents are stored privately and are available only to the people you grant access. Deleted files are purged, apart from short-lived backup copies kept for disaster recovery.
Account aggregation
Plaid connects your accounts. We only ever read.
Steward uses Plaid, the same aggregation layer trusted by thousands of financial applications, to connect your bank accounts and custodian holdings. The connection is strictly read-only: Plaid and Steward together cannot initiate transfers, move funds, or change anything at your institution.
- Read-only access: Plaid cannot initiate transactions on your behalf
- Your bank credentials are entered directly on a Plaid-hosted page and are not transmitted to, accessed by, or stored by Crossmarc
- Plaid is certified to SOC 2 Type II and maintains data-access agreements directly with financial institutions
- You can disconnect any institution at any time, and Steward stops receiving its data
Read-only
Our commitment
Your data stays yours.
Our Privacy Policy covers these commitments in more detail, including how we give notice of changes.
-
We do not sell, rent, or share your personal or financial data with any third party for marketing or analytics.
-
We do not use your data to train AI models.
-
The AI assistant works from the structure and balances you can already see, never credential-vault secrets.
-
Access logs are kept for a limited time for security purposes, then deleted.
-
You may request deletion of your account and all associated data at any time by contacting us.
Private by design
Ready to keep your records in a place built for them?
Questions about our security practices? We are happy to speak in detail.
Your data stays yours