Security Practices

1. Controls we apply

• Transport encryption — HTTPS / TLS for traffic between your browser and our hosted application.
• Password hashing — Account passwords are stored hashed (not in plain text). We never email your password to you.
• Session controls — Signed session cookies; sessions are invalidated on password reset so a stolen cookie stops working after you change your password.
• Access control — API routes that touch your journal require an authenticated session. Accounts are isolated in the application data model.
• Rate limiting — Sensitive auth and high-cost endpoints are rate-limited to reduce brute-force and abuse.
• Payments via Stripe — Full card numbers are handled by Stripe, not stored in our database. We keep Stripe customer/subscription identifiers needed to run billing.
• Least data to AI — AI features send only the content needed for the requested analysis (for example a screenshot and related trade facts), not your entire account dump.
• Secrets management — API keys and secrets are kept in server environment configuration, not shipped to the browser as customer-accessible product settings.
• Dependency and host hygiene — We run on maintained cloud hosts (for example Vercel + Neon) and update application dependencies as part of normal engineering practice.
• Breach readiness — If a notifiable data breach is likely to result in serious harm, we will notify affected individuals and the OAIC as required under Australian law, and take containment steps.

2. What we do not do

• Store full payment card numbers in our database (Stripe handles cards).
• Store passwords in plain text.
• Sell personal information to data brokers or advertisers.
• Claim that “prompting an AI once” is our entire security program.
• Pretend we are immune to novel, sophisticated attacks — we focus on known, preventable failures (exposed secrets, weak auth, open data access).

3. Infrastructure partners

Core hosting and data processing is performed by established providers listed in our Privacy Policy subprocessors table, including:

• Vercel — Application hosting, delivery, and product analytics (Vercel Analytics)
• Neon — PostgreSQL database hosting (account, journal, and product data)
• Stripe — Payment processing and subscription billing (card data handled by Stripe)
• Resend — Transactional email delivery (auth, billing, support-related mail)
• Anthropic (Claude) — AI analysis of screenshots, trade notes, analytics chat, and Nomad process grades including ICT chart reads from entry candles (Pro features)

4. Your responsibilities

Use a unique password, enable device security, do not share credentials, and notify support@nomadsys.tech promptly if you suspect unauthorised access. Reset your password immediately if you think it may be compromised.

5. Reporting a vulnerability or breach concern

Email privacy@nomadsys.tech with a clear description (no public disclosure of exploit details that would put users at risk before we can respond). We take good-faith reports seriously.

6. Related policies

Privacy · Data rights · AI disclosure · Terms