Security practices

The data we persist is: read-only exchange API credentials (encrypted), raw trade fills for the last 30 days, and aggregate analytics (Sharpe, Sortino, drawdown, daily returns) kept indefinitely. Raw fills older than 30 days are hard-deleted by a daily job; aggregates remain because the factsheet needs them.

Tenant isolation is enforced at the database. Row-Level Security policies gate every read path, and a BEFORE INSERT trigger on strategies refuses any attempt to link an api_key_id owned by a different user. The check runs with SECURITY DEFINER, so even a client bypassing application-layer RLS cannot cross tenants.

You can revoke a key and delete its strategy from your dashboard in one click. The encrypted credential row and the listing reference are removed in the same transaction; the analytics service loses its decryption path immediately.

All traffic between your browser, our web tier, the analytics service, and the exchanges is encrypted in transit with TLS 1.3. We disable TLS 1.0, 1.1, and 1.2 at the edge; internal service-to-service calls use the same profile. Certificates are issued by a public CA and rotated automatically before expiry. HSTS is enabled for quantalyze.com with a one-year max-age.

API keys are stored read-only, enforced at submission. Every key is validated against the exchange the moment you paste it — if it carries any trading or withdrawal permission, the submission is rejected before the ciphertext is written. The check and the encrypt are a single atomic round-trip.

Credential payloads are encrypted at rest with AES-256-GCM envelope encryption. Each row has its own data encryption key (DEK) generated at encrypt time; the DEK is wrapped by a platform key encryption key (KEK) stored in Supabase Vault. Only the Python analytics service, running under the service-role client, can unwrap the DEK. The Next.js web tier cannot, and neither can your own dashboard — the encrypted columns are revoked at the column-grant level from the anon and authenticated Postgres roles.

We list detected scopes back to you in the wizard — Read, Trade, Withdraw — so you can see what the exchange actually granted. Any key with Trade or Withdraw is refused; no exceptions, no admin override.

We are a pre-audit company. Preparing for SOC 2 Type 1; internal controls — access reviews, change management, vendor management, incident response — are documented and followed today, with the formal attestation to follow. Allocators evaluating us under diligence should engage our security contact for a current posture letter under NDA.

The downloadable security packet below restates the encryption spec, retention windows, exchange scopes, and incident-response contact on one page — suitable for forwarding to a risk team.

For coordinated vulnerability disclosure, our security.txt follows RFC 9116.

In the event of a personal-data breach affecting your account, we notify you within 72 hours of becoming aware of it, in line with GDPR Article 33. Notification is sent to the account email on file and, for institutional customers, to the security contact named in the onboarding record.

The notice states what data was affected, the scope of the incident, the remediation actions taken, and the contact point for follow-up. If the 72-hour window cannot be met, the notice is sent without undue further delay with a written justification for the delay, per the same Article.