Your Security Is Our Priority

Traffic between your browser and TradePulse AI is served over HTTPS (TLS) through Cloudflare, and the site sends an HSTS header so browsers keep using HTTPS. We do not claim any additional application-level encryption of data stored in our database.

Every database query made from your browser goes through server routes that deny access by default: a table that is not explicitly classified cannot be read or written at all. Private records — portfolios, trade history, bots, alerts, personal watchlists and journal entries — can only be read and written by the signed-in account that owns them, with two exceptions: site administrators can access account data for support and oversight, and shared watchlists (including ones not marked public) are currently readable by other signed-in users. Sign-in, session and credential tables are never reachable from the browser, and admin-only tables require an admin role that is checked on the server. Other community features (profiles, chat, shared strategies, trade ideas, leaderboards) are also visible to other signed-in users by design. Our own server code queries the database directly rather than through this policy. We do not use database row-level security (RLS) policies; the checks run in our application code.

Exchange API keys you save in Settings are currently kept only in your browser's local storage on your device. They are not sent to or stored on our servers, are not encrypted by TradePulse AI, and are not yet used to place trades — exchange connections are not live yet. Only save keys on a device you trust. If you create exchange keys, we recommend trade-only or read-only keys with withdrawals disabled and, where your exchange supports it, an IP allow-list.

TradePulse AI does not offer two-factor authentication (2FA) yet, so we cannot protect accounts with an authenticator app or security key today. Until it ships, use a strong, unique password or sign in with an email link, and protect the email account that receives it. We will announce 2FA here when it is available.

You can sign in with an email link (valid for 24 hours) or with an email and password. Passwords are never stored in plain text — only a salted bcrypt hash is kept. Authentication is handled by Auth.js.

Sessions use a signed session cookie (a JSON Web Token issued by Auth.js) that expires after 30 days without activity and is refreshed while you keep using the site. You can sign out at any time from your dashboard.