How we protect your financial data

Infrastructure and hosting

We run on audited cloud platforms rather than servers we patch ourselves.

• The application runs on Vercel's serverless platform (SOC 2 Type II, ISO 27001). There are no long-lived servers to patch; the runtime is maintained by Vercel.
• Data is stored in Neon serverless PostgreSQL (SOC 2 Type II), encrypted at rest with AES-256. Backups and point-in-time recovery are managed by Neon.
• All traffic is encrypted in transit with TLS. Plain HTTP is redirected, and HTTP Strict Transport Security is enforced with a two-year max-age and browser preload, so browsers refuse unencrypted connections to our domain.
• Payments are processed by Stripe (PCI DSS Level 1). Card numbers are entered into Stripe's hosted fields and never touch our servers or database.
• Secrets such as database credentials and API keys live in Vercel's encrypted environment configuration, never in source control.

Account security

Strong credentials by default, with a second factor for anyone who wants one.

• Passwords are hashed with bcrypt (cost factor 12). We cannot see or recover a plaintext password.
• Two-factor authentication with any TOTP authenticator app (Google Authenticator, 1Password, Duo, and others) is available on every account. TOTP seeds are encrypted at rest with AES-256-GCM using a key held outside the database.
• Passkeys (WebAuthn) are supported for phishing-resistant, passwordless sign-in.
• Sign-in, two-factor, registration, and password-reset endpoints are rate limited to stop credential stuffing and code guessing.
• Sessions are stored server-side. The session cookie is HttpOnly, Secure, and SameSite, and expires after 7 days (30 days for agents who choose "remember me").
• Password-reset links are single use and expire after one hour. Reset requests never reveal whether an email address has an account.

Access control and data isolation

Your data is visible only to you and to the people you explicitly invite.

• Every database query is scoped to the authenticated account. There is no cross-tenant query path in the application.
• An agent or advisor can see a client's portfolio only after that client accepts an invitation. Agents cannot see other agents' clients, and billing and branding settings are restricted to the workspace owner.
• Administrative access is limited to VestmentPulse staff and is used only for support and operations.
• Connecting an AI assistant (Claude, ChatGPT, or any MCP client) uses OAuth 2.1 with PKCE and an explicit consent screen. Access is scoped to read-only or read-and-update — never delete. Tokens are stored as SHA-256 hashes and can be revoked at any time.

Data handling and privacy

We collect what the product needs, keep it only as long as needed, and never sell it.

• We do not sell personal or financial data, and we do not use it for advertising or profiling.
• Uploaded policy statements are parsed to extract the values you asked for and then discarded. The original PDF is never written to storage.
• You can export your complete portfolio as CSV or PDF at any time from inside the app.
• You can request deletion of your account and data by emailing support@vestmentpulse.com. Deletion is completed within 30 days.
• The third parties that process data on our behalf are listed below, with what they do and why.

Application security

Defense in depth in the code itself, checked on every change.

• Browser protections are enforced with a Content Security Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy headers.
• All input is validated against typed schemas before it reaches business logic. Database access goes through a typed ORM with parameterized queries; user input is never concatenated into SQL.
• Dependencies are monitored for published vulnerabilities (GitHub Dependabot) and audited on every build. Compatible fixes are applied as they are released; advisories that require a major-version upgrade are tracked and listed under "What we are working toward" below.
• Every change runs type checking, an automated test suite, and a full production build in continuous integration before it can be deployed. Deployments are atomic and can be rolled back instantly.

Logging, monitoring, and audit

Security-relevant actions leave a record.

• A dedicated, append-only audit log records sign-ins, failed sign-ins, two-factor changes, password resets, and agent-portal access, with timestamp, IP address, and user agent.
• Agent actions on a client's records (messages, notes, tasks) are logged to that client's activity history.
• Request and error logs for every deployment are retained by Vercel and reviewed when investigating issues.

Responsible disclosure

If you find something, we want to know.

• Report security issues to support@vestmentpulse.com with "Security" in the subject line. We acknowledge reports within 2 business days and provide a status update within 10 business days.
• A machine-readable contact is published at /.well-known/security.txt.
• Please test only against accounts you own and give us a reasonable window to fix an issue before disclosing it.

Sub-processors

What we are working toward

• Major-version upgrades of three build and data-access libraries to clear the remaining open dependency advisories, after which the dependency audit becomes a hard gate on every deploy.
• Written security policies (incident response, access review, vendor management, data retention) formalizing the practices described above.
• A SOC 2 readiness assessment, scheduled when customer requirements call for a formal report.
• An independent third-party penetration test.
• Centralized long-term log retention with automated alerting on anomalous sign-in activity.