Security & Data Protection
Bank-grade data protection with row-level isolation, encrypted storage, and payment processing that never touches our servers. Zero brokerage credentials required — you stay in control.
Data Encryption
All data is encrypted at rest using AES-256 and in transit using TLS 1.2+. Your portfolio data is protected with industry-standard encryption.
Database connections use SSL/TLS. API endpoints enforce HTTPS. Authentication tokens are signed JWTs with configurable expiration. No sensitive data is ever logged or stored in plaintext.
PCI DSS Compliance
Payment processing is handled by Stripe, a PCI DSS Level 1 certified provider. We never see, store, or process your credit card numbers.
All payment forms are Stripe-hosted elements. Card data never touches our servers. Stripe handles fraud detection, 3D Secure authentication, and recurring billing. We only store Stripe customer and subscription IDs.
Data Isolation
Row-Level Security (RLS) ensures that each user can only access their own data. Your portfolio is completely isolated from other users.
Every database table enforces RLS policies at the PostgreSQL level. Even if application-level authorization were bypassed, the database would still prevent cross-user data access. Administrative access is restricted and audited.
Privacy & Data Rights
You own your data. We comply with GDPR and PIPEDA. You can request a full export of your data or permanent deletion of your account at any time.
We process only the data necessary to provide the service. We do not sell, rent, or share your personal or financial data with third parties for marketing purposes. Data retention follows our privacy policy, and you can request deletion at any time.
Infrastructure Security
Our infrastructure is hosted on secure, monitored platforms with automated updates and regular security patches.
Application hosting uses isolated containers with automatic scaling. Database backups are encrypted and stored in separate locations. Dependencies are monitored for known vulnerabilities using automated scanning tools.
Third-Party Vendors
We carefully select vendors who meet our security standards and minimize the data shared with each.
Stripe handles payments (PCI DSS Level 1). Supabase provides database and authentication (SOC 2 Type II). We do not use third-party analytics that track individual users. AI features use API calls that do not store your portfolio data on third-party servers.
Data Retention & Deletion
Your account data is retained as long as your account is active. When you request account deletion, all personal data, portfolio data, and transaction history are permanently removed from our systems within 30 days. Encrypted backups that may contain your data are rotated and purged on a regular schedule.
Before deleting your account, you can export all of your data (transactions, holdings, settings) in standard formats for your records.
Exports are AES-256-GCM-encrypted with a one-time password shown to you in the UI. We provide an open-source standalone decryption tool you can run offline:
tools/decrypt-export/decrypt.mjs
SHA-256: 040e19ba903c79e1a2996d67d3801b109c17d81c5bfebeeb1abdb77a3f804aba
Verify the checksum after downloading: `sha256sum decrypt.mjs` (Linux/macOS) or `Get-FileHash decrypt.mjs -Algorithm SHA256` (Windows). The script has no external dependencies and makes no network calls; you can audit the source in under 200 lines.
Account Security Controls
From Settings → Security you can enrol Time-based One-Time Password (TOTP) multi-factor authentication, generate single-use recovery codes, see each device that has signed in to your account and revoke any of them, review your recent sign-ins and security events, and force a 'log out everywhere else' to immediately invalidate all other browser sessions.
If we detect a sign-in from an IP address we haven't seen for your account in the past 90 days, we send you an email so you can act if it wasn't you. IPs are stored as HMAC hashes and subnet-truncated — never as raw addresses.
If we detect a high-velocity attack pattern on your account (multiple verification or two-factor failures from many distinct networks in under an hour), we send you a security email immediately — not at the next daily digest — so you can change your password and log out of all devices in the same session.
Two-factor authentication is required for all administrator accounts. Regular accounts may opt in voluntarily; we strongly recommend enabling it on accounts that hold a non-trivial portfolio.
Audit Trail & Change History
Every change to your sensitive data is recorded in an append-only audit log. When a PII field changes (name, tax citizenship, marital status, etc.) the audit row records that the field changed without persisting the before/after value itself — protecting the audit log from becoming a secondary PII honeypot.
Responsible Disclosure
If you discover a security vulnerability, please email security@stockwatcher.ca directly. We commit to a 5-business-day acknowledgement and a coordinated-disclosure timeline. See our RFC 9116 security.txt for the canonical contact record.
In scope: any vulnerability that exposes user data or bypasses authentication. Out of scope: social-engineering attempts against support staff, denial-of-service tests, and physical/onsite attacks.