Security & Trust

We only store what's needed to sync your trades and display your journal. Public journal pages use materialized trade projections. Raw broker identifiers and private broker fill records are not exposed to anonymous users.

When you connect a broker, here's what actually happens:

What we can't do with your keys: place trades, withdraw funds, or transfer assets. ClearFlow uses broker connections only for read-only sync. We do not place, modify, or cancel trades, withdraw funds, transfer assets, or initiate account activity.

Our database runs on Supabase (PostgreSQL) with the following protections:

• Row Level Security (RLS) — every table has policies that prevent one user from reading another user's data
• Broker tokens stored in Supabase Vault — API keys and session tokens are encrypted using Supabase Vault (pgsodium). The master encryption key lives outside the database, managed by Supabase. Even a full database dump gives only ciphertext — the plaintext is never persisted. Raw credential columns are blanked on storage.
• Vault access locked to service role — decrypted credentials are only accessible via our server using a privileged service role key. The vault.decrypted_secrets view is explicitly revoked from all client-facing roles (anon, authenticated). No browser request can ever read decrypted keys.
• Encryption at rest — AES-256 encryption on all data at rest, managed by Supabase
• Encryption in transit — TLS 1.3 for all connections. HTTP is redirected to HTTPS.
• Nonce-based Content Security Policy — every page load generates a unique cryptographic nonce. Only scripts tagged with that nonce can execute in your browser, blocking injected or unauthorized code. No unsafe-inline or unsafe-eval for scripts in production.
• No service role key in client code — the privileged database key never leaves the server

ClearFlow checks broker connections for common issues:

• Expired or revoked credentials — if your broker revokes access or your API key expires, ClearFlow shows a clear "Connection expired — please reconnect" message when access fails.
• WebSocket auto-disconnect — real-time streams stop reconnecting when authentication fails, preventing unnecessary retry loops with dead credentials.
• Credential cleanup — when you disconnect a broker, your encrypted API keys and tokens are deleted from Vault promptly. Your trade journal data is retained unless you explicitly delete it.

All API endpoints are protected by rate limiting via Upstash Redis to prevent abuse and protect your data. Excessive requests are automatically throttled before they reach your broker connections.

You're in control. You can revoke ClearFlow's access to your brokerage account at any time:

• From ClearFlow: Go to Broker Connections → Disconnect. We immediately delete the stored token.
• From Alpaca: Log in → API Keys → delete the key. Instantly invalidates any stored token.
• From Tastytrade: Log in → My Profile → API → revoke the session. Takes effect immediately.
• Delete your account: Go to Account Security → Delete Account. All data (trades, credentials, profile) is permanently removed.

Revoking access stops all future syncing. Your previously synced trades remain in your journal unless you request full account deletion.

ClearFlow supports TOTP-based two-factor authentication (compatible with Google Authenticator, Authy, 1Password, and other authenticator apps).

When enabled, you'll need both your password and a time-based code from your authenticator app to sign in — protecting your account even if your password is compromised.

Enable 2FA in your Account Security settings.

• We do not place, modify, or cancel trades on your behalf
• We do not store your account balance, buying power, or margin — these are fetched live and shown only to you
• We do not sell your data to third parties
• We do not use your trade data for advertising
• We do not share your private trades without your explicit consent
• We are not a broker-dealer, investment adviser, or financial institution

Found a security issue? Please disclose it responsibly to our dedicated security alias: security@getclearflow.io

Our security.txt is published at /.well-known/security.txt. A PGP key for encrypted reports is available on request.

We thank the security researchers who have helped keep ClearFlow safe. This list will be updated as reports are received and resolved.

• No public acknowledgments yet — be the first!

We do not currently run a paid bug bounty program. As an early-stage company, we prioritize fast fixes, transparent communication, and public credit. If you'd like to report a bug, please do — we treat every report seriously.