Security & data

Our approach

The Trader’s Tower handles sensitive trading data, so we collect as little as we need and protect what we store. This page summarizes our practices for users and for brokerage partners reviewing our integration.

Authentication

Accounts are protected by modern authentication (email and password with securely hashed passwords, or Google sign-in). Sessions use secure, first-party cookies. We support password reset and email verification.

Data isolation

Every record in The Trader’s Tower is scoped to the account that owns it. Data access is filtered by user at the data layer, so one user can never read or modify another user’s trades, journals, or connections.

Encryption

• In transit — all traffic is served over HTTPS/TLS.
• At rest — sensitive credentials such as brokerage access tokens are encrypted at rest using authenticated encryption (AES-GCM); they are never stored in plain text.

Brokerage access

When you connect a brokerage, the connection is deliberately limited:

• Read-only. The Trader’s Tower reads your executed orders, fills, and positions to build your journal. It cannot place, modify, or cancel orders, and it never touches your funds.
• Minimal scope. We request only the access required to import your trade history.
• No broker passwords. Authorized connections use tokens, not your brokerage login credentials, and those tokens are encrypted at rest.
• Revocable. You can disconnect a brokerage at any time, and you can revoke access from the brokerage’s side as well.

Service providers

We rely on a small set of reputable providers, each limited to its purpose:

• Railway — Application hosting and database infrastructure.
• Stripe — Subscription billing and payment processing.
• Resend — Transactional email (verification, password reset).
• Anthropic — AI-generated trade reviews (only when you use the AI debrief feature).
• Cloudflare — DNS, domain routing, and contact email.
• Connected brokerages — Importing your executed trades when you authorize a connection.

What we don't do

• We do not sell or rent your personal information or trading data.
• We do not use your trading data to place trades or for advertising.
• We do not share your data with third parties except the service providers above, or as required by law.

Your data, your control

You can export or delete your data, or delete your account, by emailing [email protected]. See our Privacy Policy for full detail.

Reporting a vulnerability

If you believe you’ve found a security issue, please email [email protected] with details. We appreciate responsible disclosure and will work to address valid reports promptly.