Security & compliance
Built like it holds your keys.
Because it does.
A platform that connects to brokerage accounts owes its members more than a promises page. Here is how the system is actually built, what we refuse to touch, and where the compliance program stands — stated plainly, including the parts that are still in progress.
Practices
The controls in place today.
Encryption everywhere
TLS in transit, encryption at rest across the stack. Brokerage OAuth tokens get a second layer of application-level encryption, with keys held in Azure Key Vault — never in code or config.
Your broker credentials never touch us
The brokerage connection uses the broker's own OAuth flow. We never ask for, see, store, or automate entry of your username, password, or two-factor codes — and we never will. Disconnecting deletes the tokens immediately.
No order leaves without a human
The platform cannot place, modify, or cancel a live order on its own — architecturally, not just by policy. AI agents stop at drafts. Every live order action is an explicit click by you.
Agent code runs in a hard sandbox
Analytics the AI writes execute in an isolated process with no network access, no environment, strict resource limits, and an import allowlist. Experimental code can never touch canonical records.
Least-privilege access
Role-based access control at every layer, managed identities instead of shared secrets in our cloud, audit logging on sensitive operations, and per-tenant data scoping enforced in the data layer.
Tested against production-shaped data
Non-production environments never see raw production data. A one-way sanitization pipeline pseudonymizes identities and strips personal content before anything leaves production, on a default-deny field policy.
Infrastructure
Boring on purpose.
The stack is built on providers whose security programs are audited at a depth no startup can match — and the sensitive parts are delegated to them by design: identity to Microsoft, card data to Stripe, key custody to Azure Key Vault.
Organization plans add isolation guarantees: a dedicated database per organization, and on the Platform tier, a fully independent deployment.
Compliance posture
What we are, and what we aren't.
- Analytics, not advice. Thesis Trading AI is analytical tooling. We are not a registered investment adviser, broker-dealer, or commodity trading advisor, and the platform does not recommend securities or place orders on its own. See the Investment Disclaimer.
- US-only, by design. The service is offered to US residents 18 and older, and our privacy program is built to US law — CCPA/CPRA and comparable state statutes. See the Privacy Policy.
- Research data, disclosed. The aggregated research datasets we build are anonymized with minimum-population thresholds, exclude Enterprise and Platform organizations entirely, and are disclosed plainly in the Privacy Policy — not buried in it.
- SOC 2 is the roadmap, not yet the report. Controls are being built to SOC 2 criteria from the start — access control, change management, audit logging, vendor management — and a formal SOC 2 Type II examination is planned as the platform scales. We will publish the report status here; until then, we won't claim the badge.
Found something?
Report it. A person reads it.
Security reports go to Security@ThesisTrading.AI and are read personally — machine-readable details live in security.txt. Good-faith research is welcome; we ask only that you avoid accessing other members' data and give us reasonable time to fix what you find.