Security
Built on encryption, RLS, and audit logging by default
Every account is isolated at the database layer, not just in application code — the same protections apply whether you're on the free trial or an Enterprise plan.
Encrypted broker credentials
Every stored broker credential is encrypted at rest with AES-256-GCM before it ever touches the database.
Row-level security everywhere
Every table enforces Postgres row-level security — your data is scoped to your account at the database layer, not just the application layer.
Multi-factor authentication
TOTP-based MFA, enforced at login and step-up-verified for sensitive actions.
Role-based access control
Organization roles (owner, admin, member, read-only) gate every action, with a separate platform-admin tier for support and operations.
Full audit logging
Every security-relevant action — logins, credential changes, broker connections, billing changes — is recorded to an append-only audit log.
Scoped API keys
Generate API keys with their own access scope, independent of your session, and revoke them individually at any time.
Session & credential management
View and revoke active sessions, rotate API keys, and manage MFA enrollment directly from Settings → Security. Every mutating action goes through the same permission checks as the rest of the platform — no special-cased admin backdoors.