How your account and data are protected, stated plainly. This is an honest description of what the product does today — not a certification.
Account protection
- Passwords are stored only as salted one-way hashes (never in plain text); a minimum length is enforced.
- Two-factor authentication (TOTP — Google Authenticator, 1Password, Authy) is available on every account, with single-use backup codes.
- Sessions are cryptographically bound to your current password hash, so changing your password (or a reset) immediately invalidates every other session.
- Rate limiting guards login, registration, password reset, and the 2FA step against brute-force and credential-stuffing.
- Password reset uses single-use, time-limited signed tokens.
Transport & application
- All traffic is served over HTTPS, with HSTS, secure cookies, and standard hardening headers (X-Frame-Options, X-Content-Type-Options, a Content-Security-Policy that forbids third-party embeds).
- The app is fully self-hosted — no third-party analytics, ad, or tracking scripts, and no external fonts or CDNs load in your browser.
- CSRF protection covers all state-changing form submissions.
- Every user's data (watchlists, portfolios, blends, alerts, saved screens) is strictly scoped to their own account.
Data
- Fund data is licensed from a third-party market-data provider and refreshed nightly. We surface the data-as-of date in the footer and disclose survivorship and monthly-frequency limits on the methodology page.
- We collect only what an account needs: your email and the analyses you save. We don't sell data or share it with advertisers (see privacy).
Honest limitations
This is an independent, early-stage tool. It is not yet independently audited (no SOC 2 report), does not offer SSO/SAML or role-based team access, and does not publish a formal uptime SLA or status page. Analytics are hypothetical and for information only — not investment advice. If your organization requires those controls for adoption, tell us — we'd rather be candid than overstate our posture.
Contact
Security questions or vulnerability reports are welcome — reach out through your account administrator. A dedicated security contact address is being set up.