Payments move bank-to-bank
Every payment is authorised inside your own banking app via open banking (Akahu). We never see, store, or transmit card numbers - there are no card details to steal, and no chargebacks.
Security
Security, spelled out.
No “bank-grade” adjectives. Here is exactly how your account, your data, and your money are protected - and the partners behind each layer.
Sessions that scripts can't read
Your sign-in lives in an HTTP-only, Secure, SameSite cookie - invisible to page scripts and never stored in localStorage. Email verification is required, and two-factor authentication is available.
Sensitive data encrypted at rest
Bank account numbers are encrypted before they touch the database. Private escrow links (status and release URLs) are stored only as hashes - the link itself is the secret, so even our own database can't leak a usable one.
Two people approve every withdrawal
Money leaving the trust account passes a dual-control queue: no single person - staff or system - can pay out alone. Every movement is also written to an append-only, hash-chained ledger that is automatically re-verified every six hours and reconciled daily.
Abuse controls on every public door
Rate limiting and bot protection sit on sign-up, checkout creation, and every public form, so the same protections that guard your money also guard your inbox.
An independent referee
wlbr is a registered NZ financial service provider (FSP1012829) and a member of FSCL, an approved independent dispute resolution scheme (registration 9690) - free for you to use if we ever can't resolve something ourselves.
Named partners
Who carries each layer.
- BNZ
- Dedicated client trust account - where your money actually sits
- Akahu
- Open-banking payment rail - bank-to-bank, no cards
- Didit
- Identity verification for sellers and high-value buyers
- FSCL
- Approved independent dispute resolution scheme (9690)
Found a security issue?
Tell us through support and it goes straight to the engineering team. For how your money is protected day-to-day, see the trust page - or watch the ledger prove it live.