Security at PortfolioTrackr
What we actually do to protect your account and your data. Every line on this page describes the product as it runs today.
PortfolioTrackr holds no money and places no trades. There is no order code in the product. Connecting a broker is optional, and a connected broker is used to read your positions and trade history, nothing else.
Your sign-in
- Passwords are stored as bcrypt hashes. We cannot read them.
- Two-factor authentication with an authenticator app (TOTP) and passkeys are available on your account.
- Sign in with Google or Apple is available. PortfolioTrackr never sees those passwords.
- Password reset links are single use and are stored only as a SHA-256 hash, so a copy of our database would not reveal them.
- New accounts confirm their email address before they are used.
Your broker connection
- Broker API keys and OAuth tokens are encrypted with AES-256-CBC before they are stored, and are never sent to your browser or to the app.
- Brokers on the SnapTrade bridge are connected on your broker's own website (OAuth 2.0). Your broker password is not typed into PortfolioTrackr.
- Direct connections (Alpaca, Bybit, Interactive Brokers) use a key or token you create at the broker, which you can revoke there at any time.
- PortfolioTrackr never places a trade, moves money or changes anything in a connected account.
Payments
Card details are entered on Stripe's hosted checkout page, or in the App Store or Google Play for app subscriptions. PortfolioTrackr never receives or stores a card number.
In transit
- Every page and API call is served over HTTPS. Browsers are told to keep using HTTPS for a year (HSTS).
- Every response carries a Content Security Policy, X-Frame-Options, X-Content-Type-Options, a Referrer-Policy and a Permissions-Policy.
- Every action that changes something in the web app carries a CSRF token.
Your data
- You can delete your account yourself from Settings. It enters a 14-day recovery period, during which you can restore it from the confirmation email; after that it is permanently deleted.
- You can ask for a copy of the data we hold about you through the contact page.
- The companies that handle parts of the service for us, Stripe, Twilio, Meta, Firebase, Anthropic and SnapTrade, are named in the privacy policy, with what each one receives.
AI features
When you import a trade from a screenshot, a voice note or a typed sentence, or ask for an AI analysis, that content is sent to Anthropic's Claude API to be processed and the result comes back to you. The screenshot itself is not stored by PortfolioTrackr. Under Anthropic's commercial API terms, content sent to the API is not used to train their models.
What we do not claim
PortfolioTrackr has not been independently audited or certified. We do not describe the product as having "bank-level security", because we cannot show you a certificate that proves it. This page lists what the product does. If any line on it stops being true, we change the line; see how we handle corrections.
Reporting a security issue
Use the contact page and say it is a security report. We read every report. This contact is also published at /.well-known/security.txt.
This page was published on 13 September 2026 and describes the product as it runs today.