Skip to main content

Trust

Security

Version 2026-09-06 · Last updated

Pythia Research is a research platform, not a broker: it never holds funds or places trades, and a brokerage connection is read-only through SnapTrade. This page describes the controls that protect the data we do hold. Questions or reports: security@pythiaresearch.org.

Reporting a vulnerability

Email security@pythiaresearch.org with what you found and how to reproduce it. We acknowledge within two business days and keep you informed until it is fixed. Please do not access other people’s data, degrade the service, or publish before we have shipped a fix. Our machine-readable contact is at /.well-known/security.txt.

Hosting and infrastructure

  • The application runs on Vercel; the database and authentication run on Supabase (managed Postgres).
  • All traffic is served over TLS; data is encrypted at rest by the hosting providers.
  • Backups: daily automated backups are retained for seven days, and restores are drilled into a throwaway project, never production.
  • Secrets live in the hosting provider’s encrypted environment store and are rotated on a written schedule with a per-key blast-radius register.

Access control

  • Every user table is protected by row-level security: a session can read and write its own rows only.
  • Plan, billing, admin and consent fields are server-owned — a browser session cannot change them, whatever it sends.
  • Database functions are closed by default; each one a browser may call is granted individually and gated in the build.
  • Administrative actions require a strict admin flag and are written to an append-only audit journal.

Your account

  • Sign in with Google, GitHub, or a one-time email code; a password can be added with a minimum of 12 characters.
  • Two-factor authentication (TOTP) is available to every account and is required for the most sensitive actions once enrolled.
  • Active devices are listed in Settings and can be signed out individually; concurrent sessions are capped per plan.
  • Brokerage secrets are encrypted with a key held outside the database; API keys are stored as hashes.

Monitoring and response

  • Errors and performance are monitored in Sentry with emails and secrets scrubbed before they leave the server.
  • Scheduled jobs are locked against overlap, heartbeat to an external monitor, and page an operator on failure or a missed fire.
  • A vendor circuit breaker stops the platform from hammering a failing data provider and records every skipped run.
  • Rate limits protect sign-in, AI, exports and the public API.

Sub-processors

The providers that may process personal data, and what each receives, are listed in the Privacy Policy. In short:

Data rights

You can export everything we hold about you and delete your account from Settings; see the Privacy Policy for retention and the full list of rights.