Security

• Email + password (bcrypt-hashed, 10 rounds, never stored in plain)
• Optional TOTP 2FA (Google Authenticator, Authy, 1Password)
• Session cookie: HttpOnly, Secure (HTTPS-only), SameSite=Lax, 7-day max age
• Login rate-limit: 5 failures → 5-minute lockout per IP
• Audit log of every login, password change, and account modification

• Every row in our database is tagged with a user_id
• Row-Level Security (RLS) policies in PostgreSQL prevent cross-user access even if app has a bug
• App-layer query enforcement adds a second line of defence

• In transit: TLS 1.2+ everywhere (Cloudflare → Vercel → Supabase)
• At rest: AES-256 disk encryption (Supabase managed)
• Backups: Encrypted, geo-redundant, 30-day retention, restore tested
• Per-user envelope encryption for high-sensitivity fields (planned, paid tier)

• Content-Security-Policy (strict, same-origin)
• Strict-Transport-Security (HSTS, 1 year)
• X-Frame-Options DENY (no embedding allowed)
• X-Content-Type-Options nosniff
• Referrer-Policy strict-origin-when-cross-origin
• Permissions-Policy locks camera/mic to first-party

Each is bound by data processing agreements:

• Supabase (database) — SOC 2 Type II
• Vercel (web hosting) — SOC 2 Type II
• Cloudflare (DNS, edge) — SOC 2 Type II, ISO 27001
• OpenAI (optional AI Advisor) — enterprise tier, zero-retention
• Resend (transactional email)
• Sentry (error tracking; PII scrubbed)

• We don't hold your money — we're never a custodian of funds
• We don't store bank credentials — we read PDF/CSV statements you upload
• We don't sell, share, or rent your data to anyone
• We don't use your data to train ML models
• We don't log SSL keys

If you find a security issue:

• Email david95oo1@gmail.com
• Include reproduction steps + your suggested severity
• We'll acknowledge within 48 hours and triage within 5 business days
• We won't pursue legal action against good-faith researchers
• Hall of fame credit for valid reports + token bounty (we're a small team)

Items in progress as we scale beyond beta:

• Independent penetration test — Q3 2026
• SOC 2 Type II readiness — Q4 2026
• Per-user envelope encryption for paid tier — Q4 2026
• Bug bounty program on HackerOne — when out of closed beta

User → Cloudflare (DDoS, TLS) → Vercel (Next.js) → Supabase (Postgres, ap-southeast-1). Sessions encrypted with iron-session. Auth: bcrypt + optional TOTP. Optional integrations: moomoo OpenD (user-local agent) → API endpoint over HTTPS; OpenAI API for AI Advisor (opt-in).