Current controls
- Verified email and secure session authentication.
- HTTPS transport on the canonical production domain.
- Authenticated user scoping and ownership constraints on journal records and private evidence paths.
- Private R2 evidence buckets with time-limited signed access.
- Rate limits on sensitive server actions and explicit degraded states.
- A separate per-user companion boundary for optional ChatGPT review.
Data boundaries
The public website does not expose private journal records. Chart images and extracted evidence are not public profile content. A pasted public TradingView snapshot is fetched for the capture you requested; saving remains subject to your verification.
Responsible reporting
Authenticated users can submit an error report through Help & support with the affected page and reproduction details. Do not include passwords, session cookies, OAuth codes, API keys, or unrelated personal data.
Known beta limits
The beta has not published an independent penetration-test report, formal certification, bug-bounty programme, or incident-response service level. These should not be implied until they exist and have an accountable operator.