Security Guide

How we protect your data

A formal security whitepaper is in preparation. In the meantime, here is how Sentinel protects your account and portfolio today:

• Encryption in transit and at rest: all traffic is served over TLS, and your portfolio holdings are encrypted with AES-GCM before they are stored.
• Isolation by row-level security: every table enforces Postgres row-level security, so your records are readable only by your own authenticated session, never by another user.
• Least-privilege access: the application can read and write only the specific columns it needs, enforced by column-level grants in the database, not just in application code.
• We never store broker credentials: brokerage connections run through SnapTrade and Tink, which handle their own authentication. We only receive the read-only positions they return.
• Authentication: sign-in is handled by Supabase Auth with email confirmation and a strong-password policy. Sessions expire after a period of inactivity.
• Deletion you control: you can export or delete your data from Settings at any time. A deleted account is held for a short grace period, then permanently purged.