Security

Your data. Your control.

A financial tool has to earn trust. Here is how we handle your data, transparently and without fine print.

Your browser

The signal and risk analysis runs here.

with you

Your dashboard analysis stays local and is not stored.

Core data

EU server, Stockholm

Core data: portfolio, account, login.

EU (Stockholm)
Payment, email, hosting

Services

  • StripePayment processingUSA (EU-US DPF)
  • ResendEmail delivery (signal alerts)USA (SCCs)
  • VercelHosting, CDN and anonymous web analyticsUSA (EU-US DPF)

How we protect your data

The edgio duck holding a key next to a safe

EU hosting

Your core data (portfolio, account, login) sits on EU servers at Supabase in Stockholm. For payment, email, hosting and analytics we use US providers under a recognised EU data-transfer framework (EU-US DPF or Standard Contractual Clauses).

Data-minimal import

Broker PDFs are parsed only transiently in memory and discarded immediately, never stored. We extract transaction data only, such as date, quantity and price. We never even read your name, account number or IBAN.

No access without your permission

Without your explicit permission, we have no access to your portfolio data. If you optionally connect an account like Parqet, we only read the transaction history you grant access to through an authorized interface, never your credentials. We do not change data in the connected service.

Runs in your browser

Signal and risk analysis runs directly in your browser. For daily alert checks, we compute server-side without requiring you to be logged in. Price data and PDF imports also flow through our servers.

Encryption & access control

Data is encrypted in transit and at rest. Row-level security technically enforces that every account can only ever see its own data. On top of that: rate limiting and modern security headers.

GDPR-compliant

Processing under EU data protection regulation: minimal data collection, cookieless analytics with no consent banner, full rights of access and erasure.

Account deletion in seconds

One click, immediate, irreversible. All portfolios, transactions, settings, and saved signal records are deleted permanently.

What we store, and what we don't

Stored

  • Portfolio composition (ticker, quantity, purchase date)
  • Signal settings and tier configuration
  • Email address (for login and alerts)

Not stored

  • Broker credentials or passwords
  • Name, IBAN, account or custody numbers (payment runs solely via Stripe)
  • The uploaded broker PDF (discarded right after parsing)
  • ISINs or security names from the import (only the resolved ticker is stored)
  • Advertising or tracking profiles and browser fingerprints
  • Your dashboard analysis (runs locally in your browser)

Third-party services

These services are involved in processing:

  • Supabase
    Purpose: Database and authentication
    Location: EU (Stockholm)
  • Vercel
    Purpose: Hosting, CDN and anonymous web analytics
    Location: USA (EU-US DPF)
  • Stripe
    Purpose: Payment processing
    Location: USA (EU-US DPF)
  • Resend
    Purpose: Email delivery (signal alerts)
    Location: USA (SCCs)
  • Market data providers
    Purpose: Price data (no personal data)
    Location: USA
  • Elbstream
    Purpose: Logo display (receives IP address and ISIN on load, not a processor)
    Location: Germany (delivered via CDN)
In your own portfolio

Try it yourself

Start for free, import your portfolio and delete the account again at any time with one click.

Free
  • Your own portfolio with up to 3 positions: score, risk and diversification
  • Up to 5 titles on the watchlist, with score and 16 signals
  • Weekly overview by email
With Pro
  • Up to 50 positions in up to 10 portfolios
  • An email as soon as a signal of your positions turns
  • Backtesting the levels with your own portfolio
  • Risk budget with your own loss floor

7 days of Pro free, then Free automatically. No credit card.

Questions about data security?