Read-only by design

Alphanta stores records about assets you own. It has no way to trade, move money or act on your accounts.

No brokerage passwords

We never ask for the password to your brokerage or bank account. Interactive Brokers users connect a Flex Query token: Flex is IBKR's reporting interface, it can only return statements and trade reports, and you can revoke the token from your IBKR account at any time.

No trading, no custody

Alphanta cannot place, route or transmit orders, and never receives, holds or transfers money or securities. Every number in the app is computed from data you entered or imported.

Account protection

• All traffic is served over HTTPS (TLS).
• Passwords are stored only as salted bcrypt hashes.
• Sessions use an HTTP-only, Secure, SameSite cookie that page scripts cannot read.
• Sign-in attempts are rate-limited to slow down password guessing.

Payments

Checkout is run by Paddle.com Market Ltd, our Merchant of Record. Card details are entered on Paddle's checkout and never reach our servers; we only receive your subscription status and email address.

Your data

• Your holdings are private to your account and are never sold or shared for advertising.
• We do not use advertising trackers.
• You can export your holdings to CSV at any time from Settings.
• You can ask us to delete your account and all associated data by writing to [email protected].

Reporting a vulnerability

If you believe you have found a security issue, please email [email protected] with the details. We will acknowledge your report and keep you updated while we fix it.