Security

Your book is yours alone

How StockGaines keeps accounts, keys and chats separate, and what it can never do.

Walls between users

Your browser talks only to the web app. The analytics engine is private and answers only calls the web server signs for your account (HMAC-SHA256 over the request, checked in constant time, with a two-minute window); a forged or altered call is refused before any work runs. The database checks your account again on every row with row-level security, which the app's own database role cannot bypass. A test suite seeds one account, calls every route as another, and fails if any answer carries the first account's data; it runs on every change.

Your keys

Keys go through a secure box straight to the vault, encrypted with AES-256-GCM under a key that belongs to your account alone, so a sealed key moved to another account does not decrypt. Each key is checked with its provider before it is stored. Keys never enter the chat or the model's context, and only the last four characters are ever shown or logged. If you paste a key into the chat by mistake, the server removes it before the model sees it.

Read-only brokerages

Brokerage links go through SnapTrade with read-only scope: positions and balances. You link your broker in SnapTrade's own portal, so StockGaines never sees your brokerage password, and it cannot move money or place trades. An import shows what would change and writes nothing until you confirm.

Sign-in

Sign in with a one-time email link, Google, or an email and password you add after proving your address. A password is kept only as a salted scrypt hash, and five wrong tries pause password sign-in for 15 minutes. Every sign-in also needs a code from an authenticator app (or one of ten single-use recovery codes); five wrong codes pause code entry for 10 minutes. Once you are in, the AI has no tool that can place an order, and any change it drafts to your account waits for your Confirm.

Orders

The one order path is a card the owner drafts in the chat, previews on E*TRADE and confirms with a click and a fresh authenticator code. A card is bound to its draft, a hash of its fields and the E*TRADE preview, expires after 10 minutes and confirms once. Confirm stays locked until the system's record beats SPY and QQQ and every other condition holds.

Audit log

Every change to your account is written to an append-only log kept for your account alone: keys saved or removed, connections, API tokens made or revoked, imports, alert rules, delivery and spend settings. Refused engine calls go to a separate log that records the path and the reason, never a key or a request body.

Where the data comes from

Data fetched with your key is stored for your account and shown only to you. The shared sources are free public data.

Report a problem

Write to us on the contact page and start the message with "Security". Please do not test against other people's accounts.