Security

What we do with your sign-in, your holdings and the files you upload.

Sign-in

No passwords. We email a link that works once and expires in 15 minutes, and it needs one click on our page, so email scanners that open links can't use it. Sessions are signed, httpOnly cookies and can be ended from the server.

Brokers

Where we connect to a broker directly, you sign in on the broker's own page. We get read access to holdings once, don't keep the broker's access token, and can't place orders. Brokers without that sign-in issue you an API key and secret in their own settings; you paste them, we use them once to read holdings and discard them. Exports and statements need no broker access at all.

Statements and files

Fund statement PDFs, their passwords and broker export files are processed in memory. We keep the holdings and transactions you confirm, never the file or the password.

AI assistants

Assistants connect over MCP: claude.ai and ChatGPT by signing in to PortfolioAI (OAuth with PKCE) and choosing one workspace, other clients with a token you create in Settings. Tokens are stored only as a hash, read-only whatever your role, tied to one workspace, stop working the moment you leave it, and can be revoked at any time.

Who sees what

Every page and API call checks your session against the workspace and your role in it. Viewers can't change anything; only owners can add admins.

Audit trail

Imports, trades, client and portfolio changes, rule changes, invitations and role changes are written to an append-only audit log for the workspace.

Advice

PortfolioAI reports facts and what-ifs from your own holdings. It doesn't recommend buying, selling or holding any security.

Found a problem? Email contact@stellitron.com.