Security & data handling

All sensitive fields (broker OAuth tokens, trade notes) are encrypted with AES-256-GCM. The encryption key lives in Supabase Vault, not in environment variables. Database backups are encrypted with a separate key managed by Supabase.

HTTPS-only (HSTS preload). TLS 1.2 minimum, TLS 1.3 preferred. HTTP requests are 308-redirected to HTTPS by Vercel’s edge before reaching the app.

OAuth2 read-only scopes only. We can read your trade history and account balance; we cannot place orders, move money, modify positions, or change account settings. The lack of write scope is enforced at the broker level — not by our code — so even a TFQ compromise cannot affect your broker account.

Every database table has ROW LEVEL SECURITY ENABLED with a policy that checks auth.uid()against the owning user’s Clerk ID. A user cannot read or write another user’s rows even via a leaked service token, because the auth context is bound to the request, not the connection.

The mistake-checker, equity curve, and analytics all run per-user. There is no aggregate dataset, no “trader leaderboard,” no “average performance.” Your data is never combined with another user’s, even anonymously, for any product feature.

PostHog and Vercel Analytics see page-view events and UTM params — they never see trade data, broker tokens, or P&L. The analytics scripts run after the cookie-consent gate (decline-by-default).

Every sensitive action — broker connection, broker token refresh, trade import, trade deletion, password change, account deletion — is recorded in a hash-chained audit log. Each entry includes a SHA-256 hash of the previous entry, so any tampering with the log is detectable: change one row and every downstream hash breaks.

You can view your own audit log at /audit (Audit tab in the sidebar). Every action attributed to your account is there with a timestamp. If you see something you didn’t do, email security@tradeflowquantum.com.

Clerk handles all authentication. We never see your password. Password hashing is bcrypt with a high work factor; rate-limiting and lockout policies are enforced by Clerk at the edge.

Two-factor authentication via TOTP (Authenticator / 1Password / Authy) is available in the Clerk account modal — click your avatar in the sidebar → Manage account → Security → Two-factor. SMS-based 2FA is not offered — SIM swaps are the dominant 2FA bypass.

JWT-based, 7-day expiration with rolling renewal. You can see and revoke active sessions in the same Clerk account modal → Security → Active devices. Revocation is instant (no “wait 24 hours”).

Settings → Account → Delete account. You confirm with your password, then the deletion is irreversible. There is no “contact support to delete” flow. We don’t want your hostage data — we want you to trust us with it because we’ll release it cleanly.

Cancelling your paid subscription does not delete your data — you stop being billed at the end of the current period and your account remains in read-only access. To actually wipe your data, use Settings → Danger zone → Delete account (described below). The two flows are separate by design.

One-shot. When you delete your account, every Supabase row and your Clerk sign-in are removed in a single transaction. There is no recovery window — once the confirmation phrase is submitted, the wipe is irreversible. Export your data first via Settings → Full data backup (JSON) if you want a copy.

Database backups roll on a 14-day window (Supabase default). Deletion of your account propagates to backups within 14 days via Supabase’s automated rotation. If you need a same-day backup deletion (compliance requirement), email security@tradeflowquantum.com.

Right to access, right to deletion, right to data portability all implemented in-product. Export from Settings → Data; delete from Settings → Account. No DPA needed for consumer accounts; available on request for team accounts.

Not certified. We implement the practices (least-privilege access, audit logging, MFA enforcement, deletion controls) but the third-party attestation costs $20-40k/yr — out of budget for a solo founder. We re-evaluate annually. If certification is a hard requirement, please email and we’ll talk about timeline.

Out of scope — payments are handled by Stripe Checkout. We never see or store card numbers. Card data goes from your browser directly to Stripe.

Not applicable. TradeFlow Quantum is for retail traders. If you’re building something that needs HIPAA or FedRAMP, you’re in the wrong product category.

Email security@tradeflowquantum.com with details. PGP key available on request.

First reply within 24 hours, business days. Critical issues patched within 7 days, high-severity within 30, others on normal release cadence. We follow disclose.io principles.

Good-faith security research is welcomed. Do not access another user’s data, exfiltrate data at scale, or disrupt service. Follow these and we won’t pursue legal action.

No formal program yet — too small to fund one. We do send a thank-you swag pack and lifetime free TFQ access for verified, responsibly-disclosed issues.

Vercel (compute, edge, CDN). Supabase (Postgres database, object storage, Vault). Clerk (authentication). Stripe (billing). Resend (transactional email). All US-based or EU-replicated providers with their own SOC 2 attestations.

Primary US-East. Database backups replicate to a second US region. No data leaves US infrastructure under normal operation.

Real-time uptime at status.tradeflowquantum.com.