Security & data handling

All sensitive fields (broker OAuth tokens, trade notes) are encrypted with AES-256-GCM. The key is a high-entropy secret held as an encrypted environment variable in Vercel (ENCRYPTION_KEY, 32+ bytes from openssl rand -hex 32), SHA-256-derived at use and never written to the database. Ciphertext carries a version byte so the key can be rotated without a re-encryption outage. Database backups are encrypted with a separate key managed by Supabase.

HTTPS-only (HSTS preload). TLS 1.2 minimum, TLS 1.3 preferred. HTTP requests are 308-redirected to HTTPS by Vercel’s edge before reaching the app.

TradeFlow Quantum contains no order-placement code path — no route, job or adapter method submits an order, and we do not intend to add one. Where the broker’s own grant also enforces that, we say so: Schwab (AccountAccess), Tastytrade (read) and TradeStation (offline_access ReadAccount) issue read-only tokens that reject a trade instruction outright. Alpaca, Tradier, Tradovate and Coinbase do not — their grants carry trade permission, because Tradovate publishes no read-only scope and the fills endpoints we sync from sit behind the trading scope on the others. Questrade, OANDA and E*TRADE use paste-token or OAuth 1.0a flows with no scope screen at all. For those seven, the read-only property is enforced by our code rather than by the broker, so treat a compromise of TFQ as reaching the brokerage connection. Every per-broker page at /supported-brokers states which case it is; if that risk is unacceptable, use CSV import instead.

Every table carries ROW LEVEL SECURITY ENABLED with a policy keyed on the owning user’s Clerk ID. In production those policies are not currently the enforcing layer: the Clerk→Supabase JWT bridge is not yet configured, so the app connects with a service role and isolation is enforced by an explicit user-id filter on every single query (146 across the API routes). The practical effect is the same for you — no request can reach another account’s rows — but we will not tell you a leaked database key would be contained by the database, because today it would not be. Finishing the JWT bridge so the policies become a second, independent layer is on the roadmap.

The mistake-checker, equity curve, and analytics all run per-user. There is no aggregate dataset, no “trader leaderboard,” no “average performance.” Your data is never combined with another user’s, even anonymously, for any product feature.

PostHog and Vercel Analytics see page-view events and UTM params — they never see trade data, broker tokens, or P&L. The analytics scripts run after the cookie-consent gate (decline-by-default).

Every sensitive action — broker connection, broker token refresh, trade import, trade deletion, password change, account deletion — is recorded in a hash-chained audit log. Each entry includes a SHA-256 hash of the previous entry, so any tampering with the log is detectable: change one row and every downstream hash breaks.

You can view your own audit log at /audit (Audit tab in the sidebar). Every action attributed to your account is there with a timestamp. If you see something you didn’t do, email security@tradeflowquantum.com.

Clerk handles all authentication. We never see your password. Password hashing is bcrypt with a high work factor; rate-limiting and lockout policies are enforced by Clerk at the edge.

Two-factor authentication via TOTP (Authenticator / 1Password / Authy) is available in the Clerk account modal — click your avatar in the sidebar → Manage account → Security → Two-factor. SMS-based 2FA is not offered — SIM swaps are the dominant 2FA bypass.

JWT-based, 7-day expiration with rolling renewal. You can see and revoke active sessions in the same Clerk account modal → Security → Active devices. Revocation is instant (no “wait 24 hours”).

Settings → Account → Delete account. You confirm with your password, then the deletion is irreversible. There is no “contact support to delete” flow. We don’t want your hostage data — we want you to trust us with it because we’ll release it cleanly.

Cancelling your paid subscription does not delete your data — you stop being billed at the end of the current period and your account remains in read-only access. To actually wipe your data, use Settings → Danger zone → Delete account (described below). The two flows are separate by design.

One-shot. When you delete your account, every Supabase row and your Clerk sign-in are removed in a single transaction. There is no recovery window — once the confirmation phrase is submitted, the wipe is irreversible. Export your data first via Settings → Full data backup (JSON) if you want a copy.

Database backups roll on a 14-day window (Supabase default). Deletion of your account propagates to backups within 14 days via Supabase’s automated rotation. If you need a same-day backup deletion (compliance requirement), email security@tradeflowquantum.com.

Right to access, right to deletion, right to data portability all implemented in-product. Export from Settings → Data; delete from Settings → Account. No DPA needed for consumer accounts; available on request for team accounts.

Not certified. We implement the practices (least-privilege access, audit logging, MFA enforcement, deletion controls) but the third-party attestation costs $20-40k/yr — out of budget for a solo founder. We re-evaluate annually. If certification is a hard requirement, please email and we’ll talk about timeline.

Out of scope — payments are handled by Stripe Checkout. We never see or store card numbers. Card data goes from your browser directly to Stripe.

Not applicable. TradeFlow Quantum is for retail traders. If you’re building something that needs HIPAA or FedRAMP, you’re in the wrong product category.

Email security@tradeflowquantum.com with details. PGP key available on request.

First reply within 24 hours, business days. Critical issues patched within 7 days, high-severity within 30, others on normal release cadence. We follow disclose.io principles.

Good-faith security research is welcomed. Do not access another user’s data, exfiltrate data at scale, or disrupt service. Follow these and we won’t pursue legal action.

No formal program yet — too small to fund one. We do send a thank-you swag pack and lifetime free TFQ access for verified, responsibly-disclosed issues.

Vercel (compute, edge, CDN, encrypted environment variables). Supabase (Postgres database, object storage). Clerk (authentication). Stripe (billing). Resend (transactional email). All US-based or EU-replicated providers with their own SOC 2 attestations.

Primary US-East. Database backups replicate to a second US region. No data leaves US infrastructure under normal operation.

Real-time uptime at status.tradeflowquantum.com.