Security and confidentiality for advice firms

Incendio Trading Limited (trading as RetireMe / Incendio Software)
Version 1.3 · 10 July 2026
This statement is for financial advice provider organisations evaluating or using the RetireMe adviser platform. It summarises how we handle firm and client information. It is not a substitute for our Adviser terms of business (PDF), and it does not amend those terms unless we agree otherwise in writing.

1. Who we are

Incendio Trading Limited (NZBN 9429051566835) is a New Zealand company. RetireMe is 100% NZ owned and operated. We design and host software for retirement modelling and adviser workflows. We do not provide regulated financial advice to your clients.

2. How adviser-platform data is held

Unlike the consumer RetireMe apps (which are local-first by default), the adviser platform stores client and firm data on our servers by design. That includes plans, CRM-style records, notes, tasks, documents, workflows, and activity / audit events needed to operate the service.

We describe this as hosted, organisation-scoped, and operationally protected — the normal model for a collaborative SaaS platform. Authorised Incendio personnel may access hosted data only as needed for support, security, maintenance, legal compliance, and running the service.

3. Roles under the Privacy Act 2020

Where we process personal information on your instructions to provide the Services:

• your firm is typically the agency responsible for that client information; and
• Incendio acts as a service provider / processor to the extent described in our Adviser terms of business.

You remain responsible for obtaining and recording any client consents required for you to use the platform with your clients, and for your own professional and regulatory obligations.

4. Confidentiality and staff access

Under our Adviser terms of business, each party must protect the other’s non-public business information received in connection with the Services and use it only for that purpose, except as required by law or with prior written consent. That confidentiality obligation survives termination for three years.

You retain ownership of your business data and client data you submit. You grant us a licence to host, process, back up, and display that data only as needed to provide the Services.

In practice for the adviser platform:

• we do not browse firm or client records for marketing, curiosity, or unrelated research;
• authorised Incendio personnel may access hosted data only as needed for support or troubleshooting (typically at your request), security, maintenance, restoration, legal compliance, or running the service; and
• we do not sell firm or client information, and we do not disclose it to third parties except through subprocessors needed to provide the Services, with your consent, or as required by law.

5. Access control and operational safeguards

We apply safeguards appropriate for a retirement-planning SaaS handling personal and financial planning data, including:

• Organisation partitioning — each advice firm is a separate tenant. Product APIs and UI scope data by organisation so one firm cannot open another firm’s clients, plans, or documents through normal use of the product.
• Role-based access (RBAC) — org admin, manager, senior, adviser, and client roles. Within a firm, access can be limited to assigned clients, team / reporting-line visibility, or aggregates-only views for certain senior roles, according to how you configure staff.
• Client portal controls — clients typically access via one-time magic links intended for their inbox; advisers control what clients can see and which documents require acceptance or signature.
• Document vault — SOA, KYC, AML, and related files stored for firm workflows, with activity history to support review and audit.
• Activity / audit trail — material interactions and document activity are logged in-product for the firm.
• Transport security — the live service is served over HTTPS (TLS).
• Backups — daily database dumps, remote site backup, and dated document snapshots to off-server object storage. See our data storage, backup and retention statement.
• Subcontractors — we may use subprocessors (for example hosting, email delivery, billing, and document storage) subject to confidentiality and privacy obligations consistent with our terms.

No software platform can guarantee absolute security. Firms remain responsible for the security of their own accounts, devices, and credentials (including multi-factor authentication where available).

6. Where data is stored (geography)

Incendio is a New Zealand company and we process personal information under the Privacy Act 2020. Company ownership and governing law are not the same as physical data location:

• Application and database — production compute and MySQL run on a Vultr VPS in Sydney, Australia.
• Adviser documents and off-site backups — file content and backup copies are held in Cloudflare R2 object storage (separate from the VPS). Those buckets use Cloudflare’s standard R2 endpoint (no New Zealand jurisdictional lock is available on R2 today).
• Other subprocessors — limited categories of data may also be processed by providers we use to run the service (for example payment processing or transactional email), only as needed to deliver the Services.

We do not currently offer New Zealand-only data residency. Australia is our primary compute region. Further detail is in our data storage, backup and retention statement.

7. Related documents

• Adviser terms of business (PDF) — commercial contract (confidentiality, privacy, IP, liability)
• Adviser terms of business (HTML) — same text, print-friendly
• Data storage, backup and retention (PDF) — hosting, backups, and retention windows
• Data storage, backup and retention (HTML) — same text, print-friendly
• Business continuity for advice firms — export, succession, and licence-period access
• Legal pack for advice firms — landing page with downloads

8. Contact

Incendio Trading Limited
Email: [email protected]
Phone: +64 22 011 2021
Website: retireme.nz

Print or PDF this page for firm due-diligence packs. Version and date above should be cited when attaching to an email or RFP response.