Security Overview

In transit

All client-server traffic is protected with TLS 1.2+ (modern ciphers only).

At rest

User data is encrypted at rest using provider-managed keys (AES-256 class). Chart uploads are retained briefly (see Privacy Policy for retention windows).

Access controls

Access to production systems is limited to authorized personnel and protected by SSO and MFA. Service-to-service access uses scoped, rotated credentials.

Subprocessors

Our vetted subprocessors are listed in our Privacy Policy.

Responsible disclosure

Found a vulnerability? Email support@tradegptchart.com with reproduction steps. Please give us a reasonable window to fix before public disclosure.