Security

Last updated: October 31, 2026

intrady is software you sign in to with your own account, and to which you can link a brokerage account. That means we take seriously how your sign-in, broker authorization, account data, and payments are protected. This page summarizes the controls that matter to you. For what we collect and share, see our Privacy Policy.

Broker connection

• Your intrady sign-in. Your password is stored by Supabase Auth only as a salted hash. Address confirmation and password recovery use one-time codes you type into the app — we never email you sign-in links.
• Official OAuth. You authorize intrady on your broker’s own site. We never receive your brokerage username or password. Each brokerage login can be linked to only one intrady account.
• Encrypted tokens. Broker access and refresh tokens are encrypted with industry-standard authenticated encryption before they are stored.
• Refresh tokens stay on the server. Your broker refresh token is never sent to the desktop application or a browser. The app receives only a short-lived access token when it needs one.
• You stay in control. You confirm every order. You can disconnect your broker in the app or revoke access through your broker at any time.

Connecting a brokerage account grants permission to display your account data and to transmit trades that you initiate. Use a dedicated account with limited funds while you evaluate the product if that is more comfortable for you.

Encryption and transport

• In transit. Connections to our services use TLS.
• At rest. Broker tokens are encrypted by our application before storage — not left as plaintext credentials. Account authentication and application data are hosted with Supabase.
• Payments. Card payments are processed by Stripe. Card numbers are handled by Stripe; we do not store full payment-card numbers on our servers.

Access controls

• Broker tokens are accessible only to our backend services.
• Access controls are designed so that you can read only your own account data.
• We use scoped service credentials and least-privilege operational access.
• Authentication sessions are managed through Supabase Auth.

What we do not do

• We do not custody your funds or securities — assets stay at your broker.
• We do not sell your personal information.
• We do not use your trading data for advertising.

Report a vulnerability

If you believe you have found a security issue, email security@intrady.com. Please include enough detail for us to reproduce the issue. Do not include secrets, live session tokens, or customer data in the report unless we ask for a specific redacted sample.

We will acknowledge responsible reports and work to address confirmed issues. We do not offer a public bug bounty at this time.

Questions

Privacy questions: privacy@intrady.com. General support: hello@intrady.com. This page is a summary of practices, not a warranty of absolute security — no online service can make that guarantee.