Two-Factor Authentication (TOTP)

All accounts can enable TOTP-based 2FA via standard authenticator apps (Authy, Google Authenticator, 1Password, etc.). Enrollment generates a set of single-use backup codes stored as bcrypt hashes — we never see the plaintext. We strongly recommend every user enable 2FA, especially Captain+ users with connected Kalshi credentials.

Session Management

Sessions are managed via Supabase Auth using HTTP-only secure cookies, not localStorage. Cookies are flagged Secure, SameSite=Lax, and rotate on re-authentication. We do not store passwords — Supabase handles password hashing using industry-standard bcrypt.

Database — Supabase (PostgreSQL)

User data is stored in a managed Postgres database with encryption at rest. Row-Level Security (RLS) policies are enforced on every table containing user data — users can only read or write their own rows. Admin actions go through service-role keys held server-side and are scoped to specific operations.

Cache — Upstash Redis

Market data, scan results, and ephemeral session state are cached in Upstash Redis (TLS in transit, encryption at rest). No PII is written to Redis. Cache keys are namespaced by data type, never by user identity.

Kalshi API Keys

Captain+ users connecting their personal Kalshi accounts provide an API Key ID (UUID) and an RSA private key (PEM). These credentials are encrypted before being written to the database — we never store them in plaintext. Decryption keys are held in Vercel environment variables, never committed to source control. Credentials are used only to execute orders you have explicitly authorized through our Auto-Trade feature.

What We Never Ask For

We do not ask for your bank login, broker password, Social Security number, or tax documents. We process payments only through Stripe — your card data goes directly to Stripe and never touches our servers. We do not have access to your full card number.