Opening your next page
No “bank-grade” adjectives. Here is exactly how your account, your data, and your funds are protected - and the partners behind each layer.
Every payment is authorised inside your own banking app via open banking (Akahu). We never see, store, or transmit card numbers - there are no card details to steal, and no card chargebacks. Bank recovery processes and legal remedies can still apply.
Your sign-in lives in an HTTP-only, Secure, SameSite cookie - invisible to page scripts and never stored in localStorage. Email verification is required, and you can require an emailed one-time code as a second sign-in step.
Bank account numbers are encrypted before they touch the database. Private escrow links (status and release URLs) are stored only as hashes - the link itself is the secret, so even our own database can't leak a usable one.
Every payout passes a review queue and is keyed and checked by the operator before it is sent. Bank confirmation is recorded before the payout is marked paid. Every movement is written to an append-only, hash-chained ledger, automatically re-verified every six hours. Every day an automatic check confirms the held balance equals the signed sum of the ledger's entries and that no held balance is negative, and signs the result. The trust account is reconciled against the bank statement by a signed daily record.
Rate limiting sits on sign-in, sign-up, checkout creation and public forms such as support and complaints, so the same protections that guard your funds also guard your inbox.
Wlbr is a registered NZ financial service provider (FSP1012829) and a member of FSCL, an approved independent dispute resolution scheme (registration 9690) - free for you to use if we can't resolve a complaint about our service.
Named partners
Tell us through support and it goes straight to the engineering team. If a message or payment request that claims to be Wlbr looks wrong, check whether it is really Wlbr or report a scam. For how your funds are protected day-to-day, see the trust page.