Your data, locked down at every layer.
We're not a broker. We don't hold your money, your card, or your broker password. We do hold your research, dashboards, and AI conversations — and we treat them like the keys to a vault.
Eight layers, one promise.
Each layer is independent — a failure in one doesn't compromise the rest. Every claim below maps to shipped code; we don't list controls we haven't built.
Account & authentication
Every account is hardened from sign-up. A Cloudflare Turnstile challenge fronts both sign-in and sign-up, we verify a real human with phone OTP, fingerprint the device, and refuse known throwaway emails — before your row is ever created.
- Phone OTP is a hard gate — until a phone is verified, the app shows the gate and nothing else
- Device fingerprint blocklist (UA + screen + canvas + timezone → SHA-256)
- Server-side disposable-email rejection via Auth Hook, before the row exists
- Phone + fingerprint blocklists outlive account deletion
- OAuth (Google) supported — no password stored for SSO users
- TOTP MFA with QR enrollment; an enrolled account must clear the second factor to reach AAL2
Sessions & access control
You can see every device that's signed in, where it is, and when it last touched the app. Revoking a session is one click — and we re-check session expiry every 30 seconds, with a five-minute warning before you're signed out.
- Multi-device session list with user-agent + last-active
- One-click revoke per session (or revoke all)
- Expiry re-checked every 30 seconds; warning toast at the five-minute mark
- Server-side session invalidation via dedicated edge function
- Role-based access control — three roles (free / pro / admin) across four billing tiers
- Daily LLM token cap consumed under a FOR UPDATE row lock, reset at UTC midnight
Data isolation & encryption
Your dashboards, watchlists, AI conversations, and broker tokens are walled off at the database level. Even a bug in our app code can't return another user's row — Postgres enforces it for us, on all 50 tables.
- Row Level Security enabled on 50 of 50 tables — zero exceptions. 32 of them also carry FORCE ROW LEVEL SECURITY
- Exactly 6 tables are world-readable, and all 6 are shared derived caches — news articles, news sentiment, morning-picks runs and results, rotation analyses, gap scans. No user data among them
- HTTPS pinned by HSTS: max-age 63,072,000 seconds (two years), includeSubDomains, preload
- SnapTrade per-user secret sealed with pgcrypto AES-256, key held in Supabase Vault
- Zero provider credentials in the shipped browser bundle — audited on the 2026-08-20 build
- The only environment values serialized into the client are the Supabase URL and its public anon key; every market-data and LLM vendor key is injected server-side by a proxy
- No advertising or analytics trackers — no ad pixels, no data brokers
Infrastructure & abuse defense
Versatum runs on Vercel and Supabase. On top of them we set a strict Content Security Policy, security headers on every response, and a per-user limiter on every proxy — so one account can't flood the vendors we pay for, or us.
- Strict Content Security Policy — object-src none, base-uri self, form-action self
- X-Frame-Options DENY and frame-ancestors none — framing blocked twice over
- Cross-Origin-Opener-Policy + Cross-Origin-Resource-Policy both same-origin
- Per-user sliding-window rate limits keyed on your account id, not your IP — shared Wi-Fi never punishes a co-tenant
- Hourly per-user ceilings sized to what each surface can cost: 20 live-order placements, 50 autonomous-agent requests, 200 RL-training requests, 10,000 model calls
- 8 browser capabilities disabled outright: camera, microphone, geolocation, payment, USB, magnetometer, accelerometer, gyroscope
- X-Robots-Tag noindex and Cache-Control no-store on every /api path
AI & prompt safety
The Copilot answers from the JSON of the one surface you have focused — a widget, a tab, or a page — and never receives another surface's data. We don't train anything on your conversations.
- JSON-grounded prompts scoped to the focused surface — no leakage across surfaces
- LLM credentials are app-owned and injected server-side; no key of ours or yours reaches the browser
- Conversation history is yours — included in your JSON export, wiped on account delete
- Chart images for the vision model are drawn in your browser; nothing is uploaded until you run the analysis
- No prompt or conversation data is sold or shared with advertisers
- Daily LLM token cap stops runaway cost and runaway prompts alike
- A value we cannot measure is disclosed as unmeasured — never quietly rendered as a zero
Brokerage & money flow
Versatum is not a broker. We never custody your money or hold your broker password — SnapTrade brokers your link, Stripe processes your payment, and both speak directly to your bank without us in the middle.
- SnapTrade integration — no broker passwords ever touch our server
- Stripe Checkout for billing — no card data ever touches our server
- PCI-DSS scope eliminated by design (we never see PANs)
- Every live ticket runs quote → broker impact preview → confirm, with commission and cash effect shown before you commit
- Live orders throttled to one per second per account, and capped at 20 per hour per user
- No model can place a trade — routing requires a human confirm on a preview that expires
- Connection-broken events surfaced — a disabled broker link reads as disabled, not as an empty account
Privacy & data rights
You own your data. Export everything we hold on you in JSON in a single click, or delete the account and we hard-wipe every linked row — including upstream broker tokens.
- GDPR Art. 15/17 self-service export — 31 tables, structured JSON, one click
- CCPA / CPRA: we do not sell or share personal information
- Account delete is a hard-delete: cascade-wipes all linked rows
- SnapTrade connection torn down in the same delete flow
- Retention pruned nightly: 730 days for the activity log and balance snapshots, 180 days for sessions and webhook events
- Standard Contractual Clauses for any non-US transfer
Monitoring & incident response
Auth events, abuse signals, and webhook failures are logged and watched. If something looks wrong, you'll know — and we'll know first.
- Activity log captures logins, MFA changes, exports, deletes
- Stripe webhooks HMAC-signed and verified server-side with a timing-safe compare
- SnapTrade webhooks verified before any state mutation, and rejected outright beyond a 300-second replay window
- Sentry-ready error pipeline (CSP allow-list configured)
- Past-due payment shows an in-app banner, never a silent lapse
- Security report channel: security@versatum.ai
From your browser to your data — every checkpoint.
Every authenticated request passes through five enforcement points before it touches a row in the database.
- 1BrowserStrict CSP, two-year HSTS, COOP/CORP and X-Frame-Options DENY on every response.
- 2Edge functionJWT verified via Supabase. Unauth requests denied at this layer.
- 3Rate limiterA sliding window keyed on your account id, with hourly ceilings per surface — tightest on live orders at 20/hr.
- 4Token capFree tier: 20k LLM tokens/day. Consumed under a FOR UPDATE row lock, reset at UTC midnight.
- 5Postgres + RLSRow Level Security on all 50 tables as a final gate — even if every prior layer fails, you can't read another user's row.
One surface you can check line by line.
Most of this page is about keeping other people out of your data. Chart Signals is about a different kind of trust: being able to verify what the software told you.
Three studies, written line by line from their reference source and run on our own bars. Each one ships beside the script it was ported from, pinned by a committed 12-character source hash, so the transliteration can be diffed against the original line by line. No model touches this surface, so the same bars always produce the same reading. Inputs are split into three classes — compute, window and presentation — which is what makes changing your view provably unable to change a measurement. And where our port departs from the source, the study says so on screen rather than in a changelog.
One clarification we'd rather make ourselves: the study we ship as Indicator Consensus ports a TradingView script published as "Neural Network". It is a weighted scoreboard, not a neural network — no training, no weights fitted to data. Its panel names every contribution that is currently paying, so you can see exactly what moved the score.
We build on providers who publish their audits.
We don't host our own data center, our own payment switch, or our own broker rails. We integrate providers who publish their own audit reports — so you inherit their posture along with ours.
To be exact about whose certifications these are: each one belongs to the provider named beside it and is published by that provider. Versatum does not hold, and does not claim, a SOC 2, ISO 27001 or PCI-DSS certification of its own.
Found something? We want to hear it.
Good-faith security research is welcome. We follow industry-standard coordinated disclosure and offer safe harbor against legal action when you stay within the rules below.