GDPR
CompliantEU General Data Protection Regulation. Taufolio is operated from Poland and processes personal data under the GDPR, with its primary database in the EU.
Taufolio Trust Center
Investors trust us with their portfolios and, when they connect a broker, with read-only access to their accounts. This page explains how we protect that data, which controls we run, who processes data for us, and it publishes the policies we work by.
Compliance
ISO/IEC 27001
ReadyPolicies and controls are designed against ISO/IEC 27001:2022 Annex A. Taufolio is not certified yet.
SOC 2
ReadyControls are designed against the AICPA Trust Services Criteria for Security, Availability and Confidentiality. No SOC 2 report has been issued yet.
“Ready” means our controls are built against the framework: the technical ones (encryption, database protection, TLS, isolated processing, retention jobs) are in place, and the procedural ones are documented and run on the schedule each policy sets. It is not a certification: no external audit has taken place yet, and we will publish the reports here when they exist.
How we protect brokerage credentials
When you connect a broker such as tastytrade or Interactive Brokers, we may hold OAuth client credentials, access and refresh tokens or API keys. Even someone with a full copy of our database could not use them.
Encrypted before it reaches the database
OAuth client IDs and secrets, access and refresh tokens and API keys are encrypted by our server with AES-256-GCM before they are stored. Each record has its own random salt and IV.
A key per user and per broker
Each record key is derived with HKDF-SHA-256 and bound to the user and the provider, so a ciphertext cannot be decrypted for another user or replayed against another broker.
The master key is never in the database
It lives only in our hosting provider’s encrypted secret store, readable by server code alone. A full copy of the database, backups included, reveals no credential.
A table no public API can reach
Credentials sit in a dedicated table with Row Level Security forced on and every privilege revoked from the public API roles. We use no anonymous or publishable database keys.
Read-only by design
We request read-only scopes: accounts, positions, balances and transactions. Taufolio never asks for trading, order, withdrawal or transfer permissions.
Never logged, deleted on disconnect
Credentials never reach logs, error reports, analytics or AI prompts, and are never sent back to the browser. Disconnecting a broker or deleting the account erases them at once.
How we protect uploaded broker statements
You can import a portfolio by uploading a statement (CSV, XLSX or XML) or a screenshot. Those files stay private to our server and are deleted on a fixed schedule.
Private store, no public link
Uploaded statements and screenshots go over TLS into a dedicated private store, encrypted at rest. No file has a public URL; every read needs a token that only our server holds.
Not reachable by anyone else
Files are stored under random identifiers. Other users, partners and the internet cannot reach them; only the platform administrator can open a retained file, to resolve a support case.
Parsed in an isolated sandbox
A parser generated for a new statement format runs in a throwaway microVM with no network, no secrets and no database access, under a hard time limit.
Deleted on a schedule
Statement files are deleted automatically 365 days after upload at the latest (we keep them so a misread file can be re-imported with a fixed parser), screenshots right after analysis. Cancelling an import or deleting the account removes them at once.
Controls
Data security
- Application-layer encryption of customer credentials (AES-256-GCM)
- Encryption at rest (AES-256) on the managed database and storage
- Encryption keys held outside the database
- Automated, provider-managed database backups
- Data classification with a Restricted tier for credentials
- Retention schedule and deletion on account closure
Database protection
- Row Level Security enabled on every table
- No anonymous or publishable database keys
- Server-side access only, with a secret key in a secret store
- Public API roles stripped of table privileges
- Views run with the caller’s rights (no RLS bypass)
Network security
- TLS 1.2+ for all traffic, HSTS on taufolio.com
- Edge network and web application firewall
- No self-managed servers or office network
- Database not publicly accessible
Product security
- Version-controlled changes with review before release
- Automated checks on every change (lint, types, unit tests)
- Full test suite and security guard tests on every release
- Instant rollback to the previous deployment
- Secrets scan that blocks credentials from the repository
- Separate development and production credentials
Access control
- Least privilege and role-based access
- Multi-factor authentication on production systems
- Quarterly access reviews
- Immediate revocation on offboarding
- No staff access to decrypted credentials
Endpoint security
- Full-disk encryption on staff devices
- Automatic operating system updates
- Screen lock and password manager
- Lost or stolen device procedure
Corporate security
- Information security policy approved by the owner
- Annual risk assessment and risk register
- Incident response and breach notification (72 h to the supervisory authority)
- Business continuity and disaster recovery plan
- Vendor and subprocessor due diligence
- Code of business conduct and acceptable use policy
Policies and procedures
36 documents, approved by Jacek Janczura and reviewed at least once a year. Each opens as a PDF.
Governance
- Information Security PolicyThe direction, principles and basic rules for how Taufolio protects the confidentiality, integrity and availability of customer and company information.
- Organization of Information Security PolicyHow Taufolio assigns information security roles and responsibilities, separates duties, and governs project security, mobile devices and remote work.
- Risk Assessment and Management PolicyHow Taufolio identifies, rates, treats and tracks security risks through a risk register reviewed annually and on significant change.
People
- Acceptable Use PolicyThe rules every Taufolio staff member follows when using devices, accounts, networks and data, and the uses that are not acceptable.
- Code of Business Conduct PolicyThe standards of conduct Taufolio expects from every staff member, how to report misconduct confidentially, and how violations are handled.
- HR Security PolicyHow Taufolio makes sure staff members are suitable, understand their security duties, and leave with their access removed.
- HR Security ProcedureThe steps Taufolio follows to onboard, train, evaluate and offboard staff members, including same-day removal of access.
Access control
- Access Control PolicyHow Taufolio grants, limits, reviews and removes access to its systems and data, based on need to know and least privilege, with MFA for staff.
- Access Control ProcedureThe steps Taufolio follows to provision, review, adjust and revoke access to critical systems, recorded in an access register.
Data protection and privacy
- Data Classification PolicyThe four classification levels Taufolio assigns to its data, with brokerage credentials and API keys at the highest level, and the handling each level requires.
- Data Protection PolicyHow Taufolio processes personal data under the GDPR, how data subject rights are handled, and how brokerage-connection data and credentials are protected.
- Data Retention and Deletion PolicyHow long Taufolio keeps data, how users can have it deleted, and why brokerage credentials are hard-deleted immediately on disconnect or account deletion.
- Encryption PolicyHow Taufolio encrypts data at rest and in transit, protects uploaded broker statements, and encrypts brokerage credentials before they reach the database.
- Media Disposal PolicyHow Taufolio securely disposes of devices and storage media so that data cannot be recovered after the equipment is retired.
- Privacy by Design PolicyHow Taufolio builds privacy into its product from the first design step: minimization, privacy by default, embedded security, transparency and user control.
Infrastructure and operations
- Asset Management PolicyHow Taufolio identifies, assigns ownership of, classifies, protects and retires its information assets.
- Asset Management ProcedureThe steps Taufolio follows to inventory, own, classify, secure and review its information assets, including devices, cloud accounts and keys.
- Communications and Network Security PolicyThe rules Taufolio applies to protect its networks, data in transit, electronic messaging and confidentiality agreements.
- Endpoint Security PolicyThe baseline every device used to reach Taufolio production or customer data must meet: encryption, updates, screen lock, MFA, and loss reporting.
- Network Security ProcedureHow Taufolio protects its hosted perimeter: edge firewall, TLS, no public database path, restricted administrative access, and periodic review.
- Operations Security PolicyHow Taufolio operates its production service securely: change control, capacity, configuration, backups, logging, and vulnerability management.
- Operations Security ProcedureThe working steps Taufolio follows for change control, backups and restore checks, logging, and vulnerability handling in production.
- Physical and Environmental Security PolicyHow Taufolio, a remote-first company with no data center, secures the places and devices where its work is done and relies on independently audited cloud data centers.
- Physical and Environmental Security ProcedureThe steps Taufolio follows to review provider data center assurance and to keep devices, screens and workspaces secure.
Product security
- System Acquisition and Secure Development Lifecycle PolicyHow security is built into every phase of acquiring, developing, testing, releasing and retiring the software behind Taufolio.
- Secure Development ProcedureThe step-by-step process Taufolio follows to take a change from requirement to production, with the checks that run before each release.
Resilience and incident response
- Business Continuity PlanHow Taufolio prepares for, declares and recovers from an extended outage, with recovery targets and the recovery mechanisms it relies on.
- Business Continuity and Disaster Recovery PolicyTaufolio's requirements for keeping information security and service availability intact during disruptions and for recovering from disasters.
- Data Breach Notification PolicyWhen and how Taufolio notifies the supervisory authority, affected users and partners of a personal data breach, in line with GDPR.
- Incident Management PolicyHow Taufolio reports, assesses, responds to and learns from information security events and incidents.
- Incident Management ProcedureThe lifecycle Taufolio follows for security incidents: detection, severity classification, response, evidence, lessons learned and a credential compromise playbook.
- Personal Data Breach Notification ProcedureThe steps Taufolio follows to report, assess and notify a personal data breach under GDPR, including the 72-hour authority deadline.
Third parties and compliance
- Compliance PolicyHow Taufolio identifies and meets its legal, regulatory and contractual obligations, protects records and intellectual property, and submits to audit.
- Compliance ProcedureThe steps Taufolio follows to identify legal requirements, review compliance, run annual audits and close corrective and preventive actions.
- Vendor Management PolicyHow Taufolio selects, contracts, assesses and reviews the third-party services it depends on or shares data with.
- Vendor Management ProcedureHow Taufolio vets, contracts, rates and reviews its vendors, and the current list of subprocessors and where they process data.
Subprocessors
Service providers that process personal data on our behalf. Market data suppliers receive no personal data and are not listed. Brokers you connect are data sources you authorize, not our subprocessors.
| Provider | Purpose | Data location |
|---|---|---|
| Vercel | Hosting, serverless compute, CDN and edge firewall | Global edge network |
| Supabase | Primary database and file storage | EU (Ireland) |
| Clerk | Authentication and session management | Provider-managed, SCCs outside the EEA |
| Stripe | Payments and subscriptions (no card data stored by Taufolio) | Provider-managed, SCCs outside the EEA |
| Resend | Transactional and broadcast email | Provider-managed, SCCs outside the EEA |
| PostHog | Product analytics, only after cookie consent | EU |
| Sentry | Error and performance monitoring | EU (Germany) |
| SnapTrade (Passiv Inc.) | Read-only brokerage connections | Canada, may also process in the US |
| Amazon Web Services (AWS Bedrock) | AI models for reports, summaries and document processing | Treated as outside the EEA |
| Anthropic | AI models for reports, summaries and document processing | Treated as outside the EEA |
| Google Cloud Vertex AI | AI models for reports, summaries and document processing | Treated as outside the EEA |
| Microsoft Azure AI Foundry | AI models for reports, summaries and document processing | Treated as outside the EEA |
| Microsoft Azure OpenAI | AI models for reports, summaries and document processing | Treated as outside the EEA |
| Microsoft Azure Document Intelligence | AI models for reports, summaries and document processing | Treated as outside the EEA |
| OpenAI | AI models for reports, summaries and document processing | Treated as outside the EEA |
| OpenRouter | AI models for reports, summaries and document processing | Treated as outside the EEA |
Frequently asked questions
How do you store the OAuth tokens and API keys of a connected brokerage account?
Encrypted with AES-256-GCM by our server before storage, with a per-record key derived from a master key that is kept outside the database. The table that holds them is unreachable through the database’s public API. See the Encryption Policy for details.
Can Taufolio place trades or move money in my brokerage account?
No. Taufolio requests read-only access only (accounts, positions, balances and transactions) and never requests trading, order, withdrawal or transfer permissions.
Who can see the broker statements I upload?
Nobody but our server, which reads them to import your portfolio. Files sit in a private, encrypted store with no public link. Only the platform administrator can open a retained file, through an administrator-only route, to resolve a support case or a parsing error. Statement files are deleted automatically 365 days after upload at the latest, and at once when you cancel the import or delete your account.
Is data encrypted in transit and at rest?
Yes. All traffic uses TLS 1.2 or higher with HSTS, the database and storage are encrypted at rest with AES-256, and customer credentials carry a second, application-level layer of encryption.
Where do you store data?
Our primary database and file storage run in the EU (Ireland). Analytics and error monitoring are stored in the EU. AI model providers may process data outside the EEA, as our Privacy Policy explains; credentials are never sent to them.
Do you train AI models on customer data?
Taufolio does not train AI models. Model providers process our requests under business API terms, which vary by provider; our Privacy Policy states what each may do with the data. Brokerage credentials never reach any AI model.
Are you ISO 27001 or SOC 2 certified?
Not yet. Our controls and policies are designed against ISO/IEC 27001:2022 and the SOC 2 Trust Services Criteria, and we describe ourselves as ready for both audits. We will publish the reports here once they exist.
What happens to my credentials when I disconnect a broker or delete my account?
They are hard-deleted immediately. Deleting the account also removes the user at our brokerage-connection provider.
How do I report a security issue?
Email support@taufolio.com with “Security” in the subject. We acknowledge every report and keep you informed until it is resolved.
Contact
Security questions, partner due diligence and vulnerability reports: support@taufolio.com.
Taufolio · Jacek Janczura · Adama Mickiewicza 73, 01-625 Warszawa, Poland · EU VAT: PL5253008276Last updated 18 October 2026. See also our Privacy Policy and security overview.