Security

We take the security of your account and data seriously. This page describes, in plain terms, the measures we have in place. It's a summary of our practices, not a guarantee — no system is perfectly secure, and we encourage you to also follow good security practices of your own, like using a unique password.

Password Protection

Your password is never stored in plain text. When you register or change your password, it is transformed using bcrypt, a deliberately slow, industry-standard hashing algorithm designed to resist brute-force attacks. We store only the resulting hash — we cannot see, recover, or email you your actual password, and no one who gains access to our database can either.

Encrypted Configuration Secrets

Third-party credentials configured by administrators (such as market-data or AI-provider API keys) are encrypted at rest using AES-256-GCM, an authenticated encryption standard, before being written to our database. These secrets are never returned to the browser once saved — the admin interface only shows whether a value is set, not the value itself.

Encryption in Transit

Traffic between your browser and StockWatch.report is encrypted using HTTPS/TLS, so data in transit — including your password during sign-in — cannot be read by anyone intercepting the connection.

Session Security

We use signed, server-verified session tokens to keep you signed in. Every action that reads or changes account data or administrative settings is independently re-verified on our servers — a valid-looking request alone is never enough; your role and permissions are checked on every request, not just assumed from the page you're on.

Role-Based Access Control

Accounts are assigned a role (free, subscriber, or admin), and administrative functions are restricted to admin accounts only, enforced independently at both the network edge and on every individual server request — not just hidden in the interface.

Responsible Disclosure

If you believe you've found a security vulnerability in StockWatch.report, please tell us before disclosing it publicly so we have a chance to investigate and fix it. Email privacy@stockwatch.report with details and, if possible, steps to reproduce the issue. We will acknowledge your report and keep you updated as we investigate. Please act in good faith: do not access or modify data that isn't yours, and give us a reasonable opportunity to address an issue before sharing it publicly.

Contact Us

For any security question or concern, contact privacy@stockwatch.report.