Your assets are kept separate from the Endowus company assets as required by the Securities and Futures Commission of Hong Kong.
All your investments are held at the custodian accounts maintained by the transfer agents of the individual fund houses (e.g. Fidelity, Invesco etc.). Your uninvested cash balances are kept in a segregated client funds account at HSBC Hong Kong, regulated by the Hong Kong Monetary Authority. These entities are regulated and have proper security measures to protect your assets.
Endowus puts our platform through a strict 3rd party assurance framework. This framework consists of regular penetration testing and continuous attack surface testing. Features such as Two-Factor Authentication (“2-FA”) and session timeout are also built with security in mind. Withdrawals from your Endowus account can only be made to your verified linked bank account in your name, after confirmation via 2-FA.