How we protect your data

Your data is isolated from everyone else's

Every row of your data — trades, notes, prop-firm accounts — is tied to your account and walled off at the database level (Postgres row-level security on Supabase). It isn't just the app being careful: the database itself refuses to hand one person another person's data. No customer can ever see your numbers.

We never see your card

All payments run through Stripe. Your card number and security code go straight to Stripe and never touch our servers — we only ever see a reference ID for your subscription. Stripe is a PCI-DSS Level 1 provider, the highest tier, and handles the card data so we don't have to.

Broker connections are read-only — and encrypted

• Connecting a broker grants read-only access to your own trading data — your orders, fills, positions, and account balances. For Tradovate and NinjaTrader you authorize Mirrored through the broker's secure OAuth screen; for Rithmic and CQG you provide the credentials your broker issued. In no case can the connection place trades, route or cancel orders, or move or withdraw funds.
• Those OAuth tokens and credentials are encrypted at rest with AES-256-GCM (authenticated encryption) before they're stored, in a server-only table the browser can never reach and that's isolated per account at the database level.
• You can disconnect a broker at any time, which revokes the access.

Encrypted in transit

Every connection to Mirrored is served over HTTPS and pinned with HSTS, so traffic between your device and us is encrypted and can't be downgraded.

Two-factor login

You can turn on two-factor login (TOTP) from Settings → Security. After your password, sign-in then asks for a rolling 6-digit code from an authenticator app — so a stolen password alone isn't enough to get in. We strongly recommend it.

Sign-in & passwords

Authentication is handled by Supabase. We never store your password in readable form — it's salted and hashed by Supabase. You can also use Sign in with Google, in which case Google verifies you and we never see a password at all.

If something ever goes wrong

If a breach affects your personal data, you'll hear it from us first — a notice to your account email without undue delay, with what happened and what we're doing about it, plus regulator notification where the law requires.

Found a security issue?

Please tell us. Email david@mirrored.online or see our disclosure policy at mirrored.online/.well-known/security.txt. We read every report and respond personally.