Built like the products your broker already trusts.

Every row we store — holdings, dividend schedules, account linkage, drift alerts — is encrypted at rest with AES-256. Encryption keys are managed outside the database tier so a stolen disk yields ciphertext, not holdings.

In transit, every connection between your browser, our servers, and our sub-processors uses TLS 1.2 or higher. We HSTS-strict our app domain and surface the policy in CSP.

Your brokerage username and password are entered directly into Plaid's interface and never transmitted to or stored by YieldPulse. We receive only read-only investment data tokens.

OAuth-style refresh tokens are stored alongside the access token under our standard encryption. We rotate them on schedule and on demand, and revoking the connection from your brokerage immediately disables our access.

YieldPulse is read-only by design. The Plaid investment API we use supports a read-only scope; we never request trade execution authority. Trades you take in your brokerage stay between you and your broker.

Every rebalance surfaced by YieldPulse is a recommendation that requires your approval in the dashboard. Confirm a recommendation and the trade list is yours to execute — manually, in your own brokerage.

YieldPulse is working toward SOC 2 Type II certification. Current status: In Progress. We will post our report publicly when available.

In the interim, we operate against a SOC-2-aligned set of internal controls: change-management discipline, privileged access gating, audit logging, and quarterly access reviews. Enterprise-grade investors can request the posture pack under NDA.

Your holdings, dividend schedule, alert rules, and treasury rotations are scoped to your account id. Every API request is authorised against your session, not by a global administrative role.

No aggregate-leak risk: a row-level access bug in one tenant's query does not bleed into another. We audit the data path quarterly.

Plaid — read-only brokerage connectivity, governed by their independent End User Privacy Policy.

Stripe — payment processing for the Pro plan. Card details never reach our database.

Resend — transactional email delivery. No marketing tooling.

OpenAI — used to draft AI explanations. Receives only a redacted snapshot (symbol, side, quantity, target allocation) — never your account or email.

PostHog — product analytics. Receives anonymised event names and properties server-side; we never send your email, holdings, or brokerage identifiers.

What we store: Plaid read-only tokens, holdings snapshots, dividend schedules, alert rules, treasury rotation rule settings, and anonymised product analytics events.

How long: account-data is retained while your account is active, then held for 30 days after deletion (soft-delete window) and permanently purged thereafter. Anonymised product analytics is retained for up to 13 months.

What happens on delete: Plaid tokens are revoked immediately, your holdings and dividend data are purged on the soft-delete sweep, and we send a deletion confirmation email to the address on file.