Security Overview
Operational controls · updated July 12, 2026 · not a certification
Current safeguards
Apertux uses HTTPS with HSTS, a restrictive content security policy, same-origin API controls, request rate limits, server-side provider credentials, Supabase row-level security, signed provider webhooks, and security event logging. Public browser code receives publishable credentials only; service-role and provider secrets remain server-side.
Operational program
Apertux reviews dependency advisories, database security and performance advisors, production health monitors, access roles, and incident contacts. Backup retention, restoration exercises, secret rotation, administrator MFA, and independent penetration testing remain recurring operational responsibilities rather than one-time claims.
Brokerage credentials
SnapTrade tokens remain server-side, encrypted separately, and excluded from browser code, logs, analytics, AI providers, and normal support tooling. Connections are read-only.
Brokerage activation gate
No security certification is claimed. Brokerage sync remains disabled until vendor review, GLBA/Safeguards analysis, threat modeling, penetration testing, deletion verification, incident exercises, and counsel approval are complete.