01 / 04
Our access boundary
You can connect a brokerage through Plaid, a financial data network. Your brokerage sign-in happens with Plaid, not TickerZone, so we never see or store your brokerage username or password.
What TickerZone can see
- Your investment holdings and positions
- Account and cash balances
- The name of the institution you linked
What TickerZone cannot do
- Move, transfer, or withdraw money
- Place, cancel, or modify a trade
- See your brokerage credentials
- Pull transaction history we did not request
02 / 04
How we protect your data
Security is a system of layered controls, not a badge. These are the safeguards currently built into how TickerZone handles linked-account access and personal data.
Encrypted in transit
Traffic is served over HTTPS/TLS, with HSTS enabled so supported browsers connect securely.
Encrypted at rest
Linked-account access tokens are encrypted in our database with rotating keys.
Least privilege
We request read-only investment data and drop products and permissions we do not use.
No trackers or data sales
We do not use advertising or analytics trackers, and we do not sell your personal data.
03 / 04
You stay in control
Disconnect anytime
Unlinking a brokerage revokes our access token with Plaid immediately.
Delete anytime
Settings → Privacy permanently erases your data, cancels your subscription, and revokes linked-account access.
04 / 04
Report a security issue
We welcome good-faith reports from security researchers. If you believe you found a vulnerability, email enough detail for us to reproduce the issue to security@tickerzone.com.
- Safe harbor. We will not pursue legal action against good-faith research that respects this policy and our users’ privacy.
- In scope. The TickerZone web application and API.
- Please do not. Access or modify data that is not yours, degrade the Service with automated scans, or disclose an issue publicly before we can address it.
- What to expect. We aim to acknowledge reports within three business days and provide updates until resolution.
Machine-readable contact details are available at /.well-known/security.txt.