Your data, locked down at every layer.
We're not a broker. We don't hold your money, your card, or your broker password. We do hold your research, dashboards, and AI conversations — and we treat them like the keys to a vault.
Eight layers, one promise.
Each layer is independent — a failure in one doesn't compromise the rest. Every claim below maps to shipped code; we don't list controls we haven't built.
Account & authentication
Every account is hardened from sign-up. We verify a real human with phone OTP, fingerprint the device, and refuse known throwaway emails — before your row is ever created.
- Phone OTP verification on signup (E.164, SMS via Supabase Auth)
- Device fingerprint blocklist (UA + screen + canvas + timezone → SHA-256)
- Server-side disposable-email rejection via Auth Hook
- Phone + fingerprint blocklists outlive account deletion
- OAuth (Google) supported — no password stored for SSO users
- TOTP MFA available for any account, with QR enrollment
Sessions & access control
You can see every device that's signed in, where it is, and when it last touched the app. Revoking a session is one click — and we re-check session expiry every minute, with a five-minute warning before kick-out.
- Multi-device session list with user-agent + last-active
- One-click revoke per session (or revoke all)
- Five-minute expiry warning toast before sign-out
- Server-side session invalidation via dedicated edge function
- Role-based access control (free / pro / pro_plus / admin)
- Atomic per-user daily LLM token cap, race-safe at the database
Data isolation & encryption
Your dashboards, watchlists, AI conversations, and broker tokens are walled off at the database level. Even a bug in our app code can't return another user's row — Postgres enforces it for us.
- Row Level Security on every table — no exceptions
- TLS 1.2+ in transit (HSTS preloaded, two-year max-age)
- AES-256 at rest (Supabase-managed; us-east-1)
- SnapTrade per-user secrets encrypted at rest with AES-256
- Application secrets only in server-side env vars — never in client bundles
- No third-party analytics or trackers loaded by default
Infrastructure & abuse defense
Versatum runs on Vercel and Supabase — both SOC 2 Type II audited providers. We add a thick layer on top: strict CSP, anti-scraping rate limits, and a request firewall on every API.
- Strict Content Security Policy — no inline scripts from unknown origins
- X-Frame-Options DENY — clickjacking impossible
- Cross-Origin-Opener-Policy + Cross-Origin-Resource-Policy isolation
- Per-user 100 req/min rate limit on edge functions
- Permissions-Policy disables camera, mic, geolocation, USB, payment, motion
- X-Robots-Tag noindex on every API path
AI & prompt safety
The Copilot only sees the JSON of the widget you're focused on — not your account, balances, or unrelated data. We never train external models on your prompts.
- Per-widget JSON-grounded prompts — no leakage across surfaces
- BYO-LLM supported — point at your own private model (Pro+/Enterprise)
- Conversation history is yours; deletable in one click
- Vision LLM screenshots stay client-side until you send them
- No prompt or conversation data is sold or shared with advertisers
- LLM token cap prevents runaway cost and runaway prompts
Brokerage & money flow
Versatum is not a broker. We never custody your money or hold your broker password — SnapTrade brokers your link, Stripe processes your payment, and both speak directly to your bank without us in the middle.
- SnapTrade integration — no broker passwords ever touch our server
- Stripe Checkout for billing — no card data ever touches our server
- PCI-DSS scope eliminated by design (we never see PANs)
- Broker order tickets show full impact preview before you confirm
- Per-account 1s rate limiter on live order placement
- Connection-broken events surfaced — no silent stale balances
Privacy & data rights
You own your data. Export everything we hold on you in JSON in a single click, or delete the account and we hard-wipe every linked row — including upstream broker tokens.
- GDPR Art. 15/17 self-service export (every artifact, structured JSON)
- CCPA / CPRA compliance — no sale of personal information
- Account delete is a hard-delete: cascade-wipes all linked rows
- SnapTrade connection torn down in the same delete flow
- Activity log retained 730 days; sessions ≤180 days
- Standard Contractual Clauses for any non-US transfer
Monitoring & incident response
Auth events, abuse signals, and webhook failures are logged and watched. If something looks wrong, you'll know — and we'll know first.
- Activity log captures logins, MFA changes, exports, deletes
- Stripe webhooks signed with HMAC + verified server-side
- SnapTrade webhooks verified before any state mutation
- Sentry-ready error pipeline (CSP allow-list configured)
- Past-due payment shows an in-app banner, never a silent lapse
- Security report channel: security@versatum.ai
From your browser to your data — every checkpoint.
Every authenticated request passes through five enforcement points before it touches a row in the database.
- 1BrowserStrict CSP, HSTS, COOP/CORP. JS bundle integrity-pinned by Vite hashes.
- 2Edge functionJWT verified via Supabase. Unauth requests denied at this layer.
- 3Rate limiter100 req/min/user. Atomic counter — no race window for floods.
- 4Token capFree tier: 20k LLM tokens/day. Atomic RPC, UTC midnight reset.
- 5Postgres + RLSRow Level Security as a final gate — even if every prior layer fails, you can't read another user's row.
We stand on audited shoulders.
We don't host our own data center, our own payment switch, or our own broker rails. We integrate the providers who already pass the hardest audits in the industry — so you inherit them.
Found something? We want to hear it.
Good-faith security research is welcome. We follow industry-standard coordinated disclosure and offer safe harbor against legal action when you stay within the rules below.