You upload years of trading history. Here is exactly where it goes, how it is protected, who can see it, and how it dies when you delete it. No legalese; the legal versions are in the Privacy Policy and Data Retention Policy.
CGT Strategist runs on dedicated server infrastructure operated by Smith Built Concepts Pty Ltd, with data in a PostgreSQL database on that infrastructure. There is no third-party data warehouse and no analytics pipeline fed with your portfolio.
Backups run automatically every night to separate storage we control, never to a third-party service. Backups are kept for 7 days and then purged, which is also the window in which deleted data disappears from backups (see deletion below).
All traffic between your browser and CGT Strategist uses TLS (Let's Encrypt certificates), and the API refuses plain HTTP outside development. Your CSV never travels unencrypted.
The sensitive documents, your uploaded broker CSV files, every generated Evidence Pack, and any CSV samples saved with custom mappings, are encrypted with AES-256-GCM before they touch the database. The encryption key lives in server configuration, not in the database. Transaction rows derived from your CSVs (trades, parcels, disposals) are stored in the database protected by the access controls below.
Every database query is scoped to your user ID. No other user can reach your workspaces, and nothing you upload is ever shown to anyone else's account. Passwords are stored as salted PBKDF2 hashes (ASP.NET Identity), and you can enable two-factor authentication or sign in with Google or Microsoft.
Nobody reviews portfolios in the normal course of running the service. A separate, role-restricted admin application does allow support staff to open a user's uploads and reports when troubleshooting a problem, and every one of those actions is written to an audit log. In practice that access is limited to the founder. We would rather tell you this plainly than claim "nobody can ever see your data" and be wrong.
Payments run through Stripe's hosted checkout. We store the Stripe transaction identifiers and nothing else; your card number goes to Stripe, not to us.
We use Google Analytics to count feature usage: an upload started, a report was downloaded, a workspace was created. Events never include portfolio values, holdings, tickers, or dollar amounts. There is no session recording, no ad pixel, and no other tracker.
Deleting a workspace removes it and everything in it, uploads, parcels, disposals, reports, from the live database immediately. There is no "deleted" flag with the data quietly retained. Deleting your account from the Profile page removes every workspace, your login, and your payment records the same way.
Deleted data can persist in nightly backups for up to 7 days before those backups are purged on schedule. After that it is gone everywhere. Abandoned free accounts are also purged automatically (after 18 months of inactivity, or 1 month for accounts that never uploaded anything), with an email warning 7 days beforehand.
If you believe you have found a security problem, please get in touch and it will be looked at promptly.