Auditable by design. Not bolted on.

JWT (HS256) with mandatory JWT_SECRET ≥ 32 chars validated at startup. bcrypt password hashing; at registration and sign-in the password is checked against the Have I Been Pwned breach corpus by k-anonymity range query — the password itself never leaves the server. TOTP two-factor authentication for administrator accounts. Per-IP ban list + per-route rate limits. MCP server calls authenticated by API key with constant-time comparison.

Per-user vendor keys (market-data feeds, model providers) stored Fernet-encrypted at rest under envelope encryption: a per-record data key wrapped by a master key that lives only in the gateway environment. No secrets in source. A redaction filter masks tokens, API keys, passwords and credentials in connection strings in every log line before it is written.

Sensitive endpoints pass through an audit middleware that hashes the request and response bodies, links each entry to the previous one (SHA-256 hash chain) and commits the row before the response is returned — a served request cannot exist without its audit row. The chain is verifiable on demand (GET /api/admin/audit/verify). Analytical runs additionally record author, route, input digest and outcome as provenance objects, so a number on screen can be traced back to the run that produced it.

470 API routers behind one manifest — every router is registered through a single reviewed registry and served by the gateway; calls from the gateway to worker nodes pass through per-node circuit breakers (3 failures in 10 s opens the breaker, 30 s cool-down), so a failing node degrades its own routes instead of the whole API. Heavy compute — backtests, stress, compliance — runs on job queues in separate worker containers, not in the request path.

Structured logs pass through a PII-redaction filter before write: JWTs, bearer tokens, e-mail addresses, phone numbers, API-key prefixes, passwords and credentials inside URLs are masked. You cannot exfiltrate PII through the logs — by construction. TLS on every host with automatic certificate renewal; HSTS, nosniff, frame-ancestors 'self' and a strict referrer policy on every response.

Single-tenant stack on Microsoft Azure, EU (Sweden Central): PostgreSQL, Redis, ClickHouse, the API gateway and the TLS edge run as one compose stack on dedicated infrastructure. The application connects to PostgreSQL under a runtime role that does not own the tables, so row-level security cannot be bypassed by the app; schema changes run under a separate DDL role. Nightly database backups to Azure Blob through a managed identity — no static storage keys — with 14-day retention.

Every repository lookup is owner-scoped: the owner identifier comes from the verified token, never from the request body, so one account cannot read another's rows even with a guessed identifier. Row-level security policies in PostgreSQL back this at the database layer, and the runtime role cannot bypass them. Isolation is a property of the data path, not a filter added on top.

Language-model calls go to NVIDIA NIM or OpenRouter with the prompt only — the ticker or question and the data slices the agents were asked about. No account credentials and no vendor keys ever enter a prompt. Provider, model and route are recorded with every run.

Our domain models are trained on public regulatory corpora (central-bank, ESMA, BIS, FATF publications) — not on customer data. Your portfolio is not in any training set. Period. Third-party inference providers receive prompts to answer, not data to learn from.

Account holders can export their data (GET /api/auth/me/export) and delete their account (POST /api/auth/account/delete) from the account settings; deleted data leaves the backups within 14 days. Everyone else can ask by e-mail. Details in the Privacy policy.

Website analytics are cookieless — Cloudflare Web Analytics, self-hosted Umami and PostHog (EU): no cookies, no cross-site tracking; PostHog keeps a random identifier in local storage, session recording is off. Application logs strip e-mail addresses, tokens and credentials before write. Transactional e-mail only — access confirmations, invitations, account notices — there is no marketing list to opt out of.

Not built yet, labelled as such: SOC 2 Type 2 audit on roadmap for Q4 2026. Private / on-prem deployment of the same container stack — by contract, not part of the standard beta. Formal DORA and MiCA alignment statements follow the audit work; until then this page describes only what runs. A written security overview for diligence is available under NDA on request.