Back to home
Security and data handling
How accounts, organisation data and public market facts are handled.
Tenant isolation
Organisation-scoped tables use database-enforced row-level security. Account roles and product grants also limit which pages and actions are available.
What is shared and what is not
- Market data
- Shared reference data. Prices, load, generation and bid curves are published by exchanges and TSOs; every tenant reads the same rows, because they are the same public facts.
- Watchlists and alert rules
- Organisation-scoped and isolated by row-level security.
- Billing
- Organisation-scoped. Card details are never held by TradingSurv; checkout and storage are handled by Stripe.
- Your own order and trade data
- Not held at all. TradingSurv surveils the published market, not your book, so there is no customer trade data in the system to isolate.
Authentication
Supabase Auth issues and verifies sessions. Protected pages check access in middleware and during rendering; database policies enforce data access.
Where data lives
- Application database
- Supabase (managed Postgres), EU region.
- Raw upstream payloads
- Cloudflare R2 object storage for captured upstream responses.
- Web application
- Vercel.
- Collectors
- Cloudflare Workers.
What we do not claim
TradingSurv does not hold SOC 2, ISO 27001 or a comparable attestation. There has been no third-party penetration test.