Trust & Safety

Security

Your financial data deserves the same protection as your money. Here's exactly how we do it.

Read-Only Access

We can never move your money or place trades.

No Stored Credentials

We never see or store your broker passwords.

Encrypted at Rest & Transit

All data is encrypted using industry-standard protocols.

MFA Support

Multi-factor authentication available for all accounts.

Broker connections

StackViewer connects to your brokerage accounts through SnapTrade, a regulated API provider that specializes in secure, read-only financial data access. The connection uses OAuth 2.0 — the same standard used by "Sign in with Google" — which means:

  • You authenticate directly with your broker, not with us
  • We receive a limited-scope access token, not your credentials
  • The token only permits reading portfolio data — no trading, no withdrawals, no account changes
  • You can revoke access at any time from within StackViewer or directly from your broker's settings

Infrastructure & encryption

StackViewer is built entirely on Amazon Web Services (AWS), one of the world's most secure and reliable cloud platforms. Our infrastructure includes:

  • Encryption in transit: All data between your browser and our servers is encrypted using TLS 1.2+
  • Encryption at rest: All data stored in our databases (DynamoDB) is encrypted at rest using AES-256
  • Serverless architecture: We use AWS Lambda functions, which reduces the attack surface compared to traditional server deployments
  • API Gateway: All API endpoints are protected and rate-limited via AWS API Gateway
  • CloudWatch monitoring: Continuous logging and alerting for anomalous activity

Authentication

User authentication is handled by AWS Cognito, a managed identity service used by thousands of enterprise applications. This means:

  • Passwords are never stored in plain text — they are hashed and salted by Cognito
  • Multi-factor authentication (MFA) is available and recommended for all accounts
  • Session tokens expire automatically and are rotated regularly
  • Failed login attempts are rate-limited to prevent brute-force attacks

Your data

We are clear about what we do and don't do with your data:

  • We do not sell your data to any third party, ever
  • We do not use your portfolio data to train AI models for other users
  • Your journal entries, emotions, and trading notes are private and visible only to you
  • You can export all your data at any time from the Trading Journal page
  • You can request full account deletion at any time by contacting support@stackviewer.net

Responsible disclosure

We take security vulnerabilities seriously. If you discover a security issue in StackViewer, please report it to us responsibly before making it public. Contact us at security@stackviewer.net with a description of the issue and steps to reproduce it. We commit to acknowledging your report within 48 hours and working with you to resolve it promptly.

We do not pursue legal action against researchers who report vulnerabilities in good faith.