This page describes the security practices actually in place today — nothing aspirational. If something isn't listed here, assume we don't claim it yet.
1. Data in Transit & at Rest
All traffic to and from ExpectancyIQ is encrypted with TLS. Your account and trade data is stored in a managed Postgres database with encryption at rest.
2. Per-User Data Isolation
Every table holding your data — trades, accounts, journal entries, reviews, broker connections — is protected by Postgres row-level security policies scoped to your user id. Application code and direct database access are both subject to the same policies: there is no code path that reads one user's trade data on behalf of another.
3. Broker Connections Are Read-Only
Automatic cTrader sync uses a read-only OAuth scope. It can only read your account list and trade history — it cannot place, modify, or cancel orders, and cannot move funds. See our Risk Disclosure for what the Service does and does not do.
4. Payments
Subscription billing is handled by Stripe. ExpectancyIQ never receives or stores your full card number — Stripe holds payment details and we only receive your subscription status and billing history.
5. Error Monitoring
We use Sentry to capture application errors so we can find and fix problems quickly. Error reports are used for debugging only, not analytics or advertising.
6. Account Access
Sign in with email/password or Google OAuth. Your session is tied to your account, and you can revoke it by signing out or changing your password at any time.
7. Reporting a Concern
If you believe you've found a security issue, please contact us directly rather than filing a public report, so we can investigate before any details are made public.