Security

Email security@getportfoliocopilot.com with a description and reproduction steps. We aim to acknowledge within 3 business days.

• Row-level isolation. Every user-owned table (profiles, portfolios, holdings, saved digests) enforces row-level security scoped to your account. A user can only read or write their own rows.
• Shared reference data. Cached news, AI insights, and filing summaries are read-only for signed-in users and contain no personal data.
• Email infrastructure. Delivery logs and unsubscribe tokens are reachable only by trusted server processes, never by the browser.
• Server-only secrets. Privileged database credentials and AI gateway keys stay on the server and are never included in the browser bundle.

We collect the minimum required to operate the product:

• Your email address — for sign-in and transactional email.
• Your first name — greeting personalization only.
• The holdings you type in — symbol, quantity, and average price.

We never ask for brokerage logins, bank details, government identifiers, or card numbers. There is no broker connection to compromise.

An automated daily cleanup job removes short-lived data on a fixed schedule:

• Cached news articles — 30 days.
• AI news insights — 30 days.
• Portfolio news digests — 60 days.
• Email delivery logs — 90 days.
• Unsubscribe tokens — 30 days after use, 90 days if unused.

Your account details, portfolios, and holdings are retained until you delete your account. Deleting your account cascades to every row you own.

• AI calls run server-side through our gateway. Your browser never holds an AI provider key.
• AI providers are engaged as processors under terms prohibiting training their foundation models on our customers' inputs or outputs.
• The assistant is instructed never to give buy, sell, or hold recommendations, and never to predict prices.

• All traffic is served over HTTPS with HSTS enforced.
• The database is encrypted at rest by our infrastructure provider.
• Responses carry X-Content-Type-Options, Referrer-Policy, X-Frame-Options, and Permissions-Policy headers.
• A single canonical domain is enforced with a permanent redirect from www.

• Managed Postgres and authentication provider — database, accounts, sessions.
• AI gateway and model providers — briefings, news analysis, assistant replies.
• Email delivery provider — transactional email from our own verified domain.
• Public market data sources — prices, news feeds, and official exchange filings. These requests do not include your identity.

Portfolio Copilot is an independent product and holds no third-party security certification — no SOC 2, no ISO 27001, and no completed external penetration test. We are not a registered investment adviser. Everything on this page describes controls we actually operate, and nothing more.