Security

Brokerage linking is handled by SnapTrade. You enter your credentials with SnapTrade or with your brokerage, never with Stnding, and we never see them. What we receive back is read-only: positions, balances, cash movements and executed orders.

We do not request, and cannot obtain, the ability to place an order, transfer cash, change your brokerage settings or withdraw anything. You can revoke the connection at any time from your brokerage, from SnapTrade, or by disconnecting in Settings. Deleting your Stnding account also asks SnapTrade to delete the user it holds for you.

SnapTrade’s own security posture, including its certifications, is described at snaptrade.com/security. Those are its certifications, not ours.

Sign-in is handled by Supabase Auth. Passwords are stored only as hashes and we never see them in the clear. Sessions use first-party cookies marked secure and same-site in production. Sign-in, password reset and account-creation endpoints are rate limited, and repeated failures back off.

Account and record data is stored in Ireland, encrypted in transit and at rest by our database provider. Every table carries row-level security, so one account cannot read another’s rows even if a query tried. Administrative access is limited to the operator and is used for running the service.

The site is served over HTTPS with strict transport security. Pages cannot be framed by another site, content types are not sniffed, and a content security policy is deployed in report-only mode while we confirm it admits everything the site loads.

The publication delay and Discreet Mode are applied on the server before a page is built. A visitor who is not entitled to a day of your record is not sent that day, and a discreet record’s amounts are removed from the response rather than hidden by the browser. Viewing the page source of someone else’s record does not reveal what the record withholds.

This protects what has not been published. It cannot retrieve what has: anyone who could read your record before you tightened a setting may have kept a copy.

• Your brokerage password, outside the SnapTrade connection flow
• Permission to trade, transfer or withdraw
• Identity documents, or a photograph of one
• A payment to release, restore or verify your record

If someone claiming to be Stnding asks for any of these, it is not us. Tell us at team@stnding.com.

Stnding is run by one operator. We hold no security certification of our own, we have not commissioned an external penetration test, and two-factor authentication is not yet available. We would rather say so than imply otherwise. If any of that changes, this page changes with it.

Send what you find to team@stnding.com with enough detail to reproduce it. We will acknowledge a good-faith report and tell you when it is fixed.

While testing, please stay inside these limits:

• Use only accounts you control, and do not access anyone else’s data
• Stop at the point of proof: do not read, copy, alter or keep another person’s data, and tell us instead
• Do not degrade the service, and do not run denial-of-service or spam tests
• Do not use social engineering or attack our providers
• Give us reasonable time to fix it before you tell anyone else

Research that stays within those limits is authorised, and we will not pursue a claim over it. We do not run a paid bounty programme, so no payment should be expected.

Privacy questions go to the same address and are answered under the Privacy Policy.