Trust
Security
Effective 25 July 2026
The strongest security property here is what the product refuses to hold: no passwords, no broker keys, no card numbers. What is not stored cannot be stolen.
Authentication
- Sign-in is a single-use link, valid for 15 minutes. There is no password to guess, reuse, or leak.
- Only hashes of sign-in tokens and session tokens are stored. A leaked database row cannot be replayed.
- Sessions are server-side records with a 30-day lifetime, listed and revocable from your account page.
- Sign-in responses are identical whether or not an address has an account, so the endpoint cannot be used to discover who is registered.
Isolation
Every private object carries an owner, and every read is scoped to the signed-in account. Partner and affiliate surfaces are served from aggregates and can never reach an individual member's decisions or figures. tested
What we never hold
- Broker or exchange API keys — the product cannot connect to a trading account at all.
- Card numbers — payment details go directly to the payment provider.
- Passwords — there are none.
Integrity of the record
Decisions are versioned and append-only. Each version carries a SHA-256 receipt over its canonical contents, so a stored payload cannot be altered later without the hash disagreeing.
To be exact about what that proves: it shows the record has not changed since it was written. It does not prove the values you entered were true, and no screen in the product claims otherwise.
Failure behaviour
When a stage fails, the decision halts in a visible broken state and waits for a human. It never degrades into an approval. A model being unavailable is labelled as unavailable rather than silently skipped.tested
Reporting a vulnerability
Report anything you find to the address on the contact page with enough detail to reproduce it. We acknowledge within one business day and will keep you updated until it is fixed.
We will not pursue legal action against good-faith research that avoids privacy violations, service degradation, and data destruction. Please test against your own account, and give us reasonable time to fix an issue before disclosing it. There is no paid bounty programme yet; credit is offered where you want it. not yet measured
What is not yet in place
Honesty is part of this page. There has been no external penetration test and no SOC 2 or ISO certification. Separate database roles per module are enforced in the application layer rather than by the database itself. These are named here rather than omitted, and this page will be updated when each changes. not yet measured