Invest

Learn

Pricing

Help Center - StashAway

Help Center

At StashAway, we take security seriously and strive to ensure that while we focus on customer experience, usability and product reliability, it is secured as well. However, nothing is perfect and we encourage the reporting of suspected vulnerabilities or weaknesses in our IT services and systems through our Vulnerability Disclosure Programme (VDP).
You can find more information on how to report <a class="c-link" tabindex="-1" href="https://vdp.stashaway.com/" target="_blank" rel="noopener noreferrer" data-stringify-link="https://vdp.stashaway.com/" data-sk="tooltip_parent" data-remove-tab-index="true">here</a>.
 
Please also note that the VDP does not authorise or permit the taking of any action which may contravene applicable laws and regulations (e.g. Computer Misuse Act). For the avoidance of doubt, attempts to exploit or test suspected vulnerabilities (e.g. gaining unauthorised access to any computer program or data) are prohibited.

How to report security vulnerabilities?

We have taken every possible measure to protect your assets, from requiring two-factor authentication for any changes and identity verification for withdrawals, building a secure server infrastructure to protect you from cyber attacks, and partnering with a large bank to store your assets. To learn more, please visit <a href="https://www.stashaway.hk/security">this link.</a>

What safeguards does StashAway have in place to ensure that my assets are protected from fraud?

Your money is kept entirely separate from StashAway's finances. To ensure that we never touch your money, we use custodian banks that hold your money, whether it's in cash or in securities.
StashAway has made it a top priority to work with global, reputable banks for these purposes. Our custodian bank for receiving your deposits is Citibank (Hong Kong) Limited while Citibank and HSBC hold your securities and investable cash in Singapore, respectively through a trust account maintained by our broker (Saxo Capital Markets Pte Ltd). 
In these custodian institutions, your assets are always in a segregated account-- one that is separate from StashAway's operations and assets. This means that you will always have full access and claim to your assets no matter what happens to StashAway.

What happens to my money if StashAway gets acquired, goes public, or closes?

As a fully regulated investment advisory and asset management firm, we are obliged to obtain verification of the identity of customers as part of our customer due diligence requirements. 
Documents are requested only via our corporate WhatsApp number which is connected to our secured StashAway network, protected by firewall and requires multi-factor authentication to access. It is a VPN, just like your bank’s intranet.
WhatsApp also has end-to-end encryption, while other channels like emails do not.

Is it secure to send my information over Whatsapp?

We do not outsource customer service to third party providers. All our staff are trained in-house so that we have tighter controls over the onboarding process, and our Client Experience team does not forward customer documents to any other department in the company.
Access to our corporate network is only for authorized personnel and specific devices.  We practice the Principle of Least Privilege, where we only assign just enough access for a staff to perform his or her job. Hence, only very limited staff has access to customer information.
We are fully compliant with the Personal Data (Privacy) Ordinance in Hong Kong and Securities and Futures Commissions (SFC) <a href="https://www.sfc.hk/-/media/EN/assets/components/codes/files-current/web/guidelines/management-supervision-and-internal-control-gu/management-supervision-and-internal-control-guidelines-for-persons-licensed.pdf">Guidelines</a>.

Who has access to my information?

Your personal information is securely stored in our databases, in accordance with Hong Kong’s regulations and other applicable data protection and privacy laws. Where the business is required to share such information in the process of providing our services to you, care is given to ensure that the same duty of confidence and security is applied.
Learn more about our security: <a href="https://www.stashaway.hk/security-regulation">StashAway Security.</a>

Where is my personal information stored?

You may, at any time, withdraw your consent to the collection, use, or disclosure of personal data from us. One way to withdraw your consent is to click “Unsubscribe”, available on all marketing or newsletter emails that you may receive from us. 
Otherwise, you may contact our Data Protection Officer at dataprotection@stashaway.com, should you require more assistance. We will strive to process your withdrawal request within 10 business days and will inform you accordingly should we need more time. 
We also strive to inform you of any likely consequences as a result of your withdrawal request.

How do I withdraw consent previously given in relation to my Personal Data?

The categories and suggestions below, many of which may apply to your home as well as your office, are some suggestions which you can and should adopt to ensure a secure online experience:
 
Protect your computer
<ul class="wysiwyg-text-align-justify">
<li style="font-weight: 400;" aria-level="1">Install anti-virus software and the latest security patch on the computer you use to access StashAway.</li>
<li style="font-weight: 400;" aria-level="1">Set it so that it performs automatic updates.</li>
<li style="font-weight: 400;" aria-level="1">Remove file and printer sharing, especially when connected to the Internet.</li>
<li style="font-weight: 400;" aria-level="1">Consider the use of encryption technology and perform regular backups to protect critical data.</li>
<li style="font-weight: 400;" aria-level="1">Only allow trusted USB drives into your computer.</li>
<li style="font-weight: 400;" aria-level="1">Get in the habit of locking your account whenever you step away from your computer.</li>
<li style="font-weight: 400;" aria-level="1">Only use trusted devices and access trusted websites.</li>
<li style="font-weight: 400;" aria-level="1">Do not install or run programs that are not from trusted websites.</li>
<li style="font-weight: 400;" aria-level="1">Delete junk or chain emails.</li>
<li style="font-weight: 400;" aria-level="1">Do not access sensitive online sites or perform financial transactions over the public Internet.</li>
<li style="font-weight: 400;" aria-level="1">Clear browser cache after each online session.</li>
<li style="font-weight: 400;" aria-level="1">Log off after each online session.</li>
</ul>
 
Protect your mobile device
<ul class="wysiwyg-text-align-justify">
<li style="font-weight: 400;" aria-level="1">Always update your device to the latest available OS version; these patches normally carry security and bug fixes that will help secure your device and the information stored on it.</li>
<li style="font-weight: 400;" aria-level="1">Do not attempt to ‘jailbreak’ or ‘root’ your device.</li>
<li style="font-weight: 400;" aria-level="1">Keep your laptop, mobile phone, and other portable devices that contain sensitive information with you at all times.</li>
<li style="font-weight: 400;" aria-level="1">We would strongly advise against logging in via public wifi networks.</li>
</ul>
 
Protect your network
<ul class="wysiwyg-text-align-justify">
<li style="font-weight: 400;" aria-level="1">Set a strong password for your WiFi network.</li>
<li style="font-weight: 400;" aria-level="1">
Do not allow anyone to connect to your network without permission. 
</li>
</ul>
You can also learn more about protecting your data and finances in our article <a href="https://www.stashaway.hk/r/12-ways-to-protect-your-data-and-finances-">here</a>.

How should I protect my Devices and Computer Systems?

Digital certificates provide security to websites by encrypting sensitive data and verifying the identity of the websites that are secured. 
SSL problem messages and warnings are often displayed in an attempt to protect website users from potentially compromising situations. 
If you ever encounter an SSL-related warning (such as a security certificate mismatch, certificate not trusted, or secure and non-secure items) while visiting StashAway’s site, you may want to hold off on entering your login details until you can make sure you are not in a compromising online situation. 
To resolve a problem that you may be having, the first thing that you may want to check is that your computer's time and date are accurate. Because expired or not-yet-valid security certificates throw up warnings, having the date on your machine wrong could potentially cause security errors on many secure sites that you access. 
Additionally, if you have recently enabled new secure settings in a website, try disabling those settings and see if the warning messages go away. While this is not a fix, it can give you a point to work from when communicating with our Client Engagement Team and help them to provide more details for our team of experts to fix the issue faster. 
If the problem persists, contact us via email at support@stashaway.hk and our team of experts are available to help resolve the issue.
Reference: <a href="https://www.digicert.com/ssl-problems.htm">https://www.digicert.com/ssl-problems.htm</a>