SECURITY & PRIVACY

Your data is yours.
We take that seriously.

TradeMind handles your trading psychology, P&L data, and daily mental scores. Here is exactly how we protect all of it — no marketing language, just facts.

No passwords stored
PCI DSS (via LemonSqueezy)
Encrypted at rest
Vercel SOC 2 infra
GDPR compliant

No Passwords, Ever

ZERO-KNOWLEDGE AUTH

TradeMind uses magic-link authentication only. We never create, store, or transmit a password on your behalf. Your email is used solely to send a one-time login link — after that, your session is managed by a signed, httpOnly cookie that we cannot read the contents of. If someone breaches our database, there are no passwords to steal.

Magic-link email auth via NextAuth.js
Session tokens are signed and httpOnly — not accessible via JavaScript
No OAuth tokens stored for social login

Broker Credentials Never Touch Our Servers

THIRD-PARTY OAUTH

When you connect your broker via the MetaAPI integration, your brokerage username and password are entered directly on MetaAPI's encrypted OAuth flow — they are never transmitted to or stored on TradeMind servers. We only receive a read-only access token, scoped to trade data. We never have the ability to place trades on your behalf.

MetaAPI handles all broker OAuth — we receive only a scoped read token
Read-only access — TradeMind cannot place, modify, or cancel trades
You can revoke access from your broker portal at any time

Payments via LemonSqueezy — We Never See Your Card

PCI DSS COMPLIANT

All billing is handled by LemonSqueezy, a PCI DSS Level 1 certified payment processor — the highest standard in payment security. Your card number, CVV, and billing address are entered directly on LemonSqueezy's hosted checkout. TradeMind's servers never receive, process, or store any payment card data.

LemonSqueezy is PCI DSS Level 1 certified
Card data is entered on LemonSqueezy's domain, not ours
TradeMind stores only a LemonSqueezy customer ID and subscription status
Invoices and receipts are issued by LemonSqueezy directly

Encrypted Database at Rest

TURSO / LIBSQL

Your check-in scores, journal entries, and psychology data are stored in Turso (LibSQL), a distributed SQLite database with encryption at rest enabled by default. Data is replicated across multiple regions for durability. We do not store any data in plaintext on our servers.

Turso LibSQL database with encryption at rest
All connections use TLS 1.2+ in transit
No plaintext storage of sensitive data
Database access restricted to authenticated API routes only

Hosted on Vercel — SOC 2 Type 2 Infrastructure

ENTERPRISE CLOUD

TradeMind is deployed on Vercel's infrastructure, which maintains SOC 2 Type 2 certification. This means independent auditors have verified Vercel's security controls for availability, confidentiality, and processing integrity. All traffic is served over HTTPS with automatic TLS certificate management.

Vercel is SOC 2 Type 2 certified
Automatic HTTPS/TLS for all traffic
Edge network with DDoS protection
No user data stored in Vercel's logs beyond standard access logs

Your Data Belongs to You

FULL PORTABILITY

You own your data, full stop. You can export everything — check-in history, scores, journal entries, and P&L — at any time from your Settings page. If you delete your account, all your data is permanently removed from our database within 30 days. We do not archive deleted accounts.

Export all data as JSON from Settings → Export Data
Account deletion removes all records permanently
No backup copies of deleted user data retained after 30 days
Data deletion requests honored within 30 days per GDPR

We Never Sell Your Data

PRIVACY FIRST

TradeMind's business model is subscriptions — not advertising, not data brokerage. Your trading psychology data, P&L figures, journal entries, and behavioral patterns are yours alone. We do not sell, license, or share identifiable user data with any third party, advertiser, or data broker. Period.

No advertising network integrations
No data broker partnerships
Anonymous, aggregated analytics only for product improvement (e.g., PostHog)
You can opt out of all analytics from Settings
RESPONSIBLE DISCLOSURE

If you discover a security vulnerability in TradeMind, please email us at security@trademindedge.com before disclosing publicly. We will acknowledge your report within 48 hours and work with you to resolve the issue. We genuinely appreciate responsible security research.

Privacy PolicyTerms of ServiceContact Us