TradeProp

TradeProp Security

Last updated: 24 July 2026

This page describes how TradeProp protects your data. For what data we collect and why, see our Privacy Policy. If you have a specific security question we haven't answered here, contact us at sam@tradeprop.app.

Hosting infrastructure

TradeProp runs on:

  • Supabase for our database, authentication, and file storage. Supabase is SOC 2 Type 2 compliant, ISO 27001 certified, and HIPAA-eligible.
  • Vercel for application hosting. Vercel is ISO 27001:2013 certified, holds a SOC 2 Type 2 attestation, and is PCI DSS and GDPR compliant.

We don't run our own servers, both providers are established infrastructure platforms with their own independently audited security programs.

Data location: Sydney, Australia. Both our database and our application hosting run in the Sydney region (ap-southeast-2), your data doesn't leave Australia to be stored.

Encryption

  • In transit: every connection to TradeProp, and every connection TradeProp makes to a third-party service (Stripe, Brevo, Anthropic, etc.), is encrypted using TLS 1.2 or higher (TLS 1.3 where the connecting client supports it), the same standard used across Supabase's and Vercel's own platforms. There's no unencrypted path anywhere in the system.
  • At rest: all data stored in our database and file storage is encrypted at rest (AES-256), by default, as part of Supabase's and Vercel's infrastructure.

Authentication

You can sign in to TradeProp using:

  • A password (we never store your password in plain text, only a securely hashed version).
  • Google sign-in (OAuth), if you'd rather not manage a separate password.
  • A passkey (Face ID, Touch ID, Windows Hello, or a hardware security key), for phishing-resistant sign-in.

Signup and login are protected against automated bot attacks using Cloudflare Turnstile.

Payment data

TradeProp never sees or stores your credit card details. All payment collection happens directly through Stripe, our payment processor, using their hosted checkout and billing portal. This keeps TradeProp itself outside the scope of PCI-DSS card-data requirements, that responsibility sits with Stripe, a payment processor built for exactly this.

Secrets and credentials

API keys and other sensitive credentials TradeProp uses to talk to third-party services (Stripe, Brevo, Anthropic, etc.) are stored using our hosting platform's environment variable system, not committed to source code or accessible outside the application's own server environment.

Backups

Our database is backed up automatically once a day.

Incident response

If we become aware of a data breach that's likely to result in serious harm to affected individuals, we'll follow the process required under the Notifiable Data Breaches scheme (Privacy Act 1988): assess the breach, notify the Office of the Australian Information Commissioner (OAIC), and notify affected individuals, without unreasonable delay.

Questions

If you've found a security issue or have a question about how we protect your data, contact us at sam@tradeprop.app.