Security, and what this service cannot do

The most useful security property here is not a clever piece of cryptography. It is an absence: this service has no connection to your brokerage account, and no way to get one.

We never ask for, receive, or store

Your brokerage API keys
Your brokerage login, password, or 2FA codes
Your account number, balance, or holdings
Any bank details, card, or payment method — the service is free
Your name, address, phone number, or date of birth

All we hold is an email address, a hashed password, your two-factor secret and backup-code hashes if you turned that on, and whatever positions you choose to type in for tracking. You place every trade yourself, in your own brokerage, with your own hands. Nothing here can move a cent of your money, because nothing here is connected to it.

Why we built it this way

An earlier design would have let you connect an API key so the service could rebalance automatically. It would have worked. We removed it deliberately, because to trade while you are asleep the server must be able to decrypt your key without you — so no matter how good the encryption, you would have to trust that we, and everyone who ever gets access to our servers, behave. That is a large thing to ask for a free tool.

Handing an API key to any third-party service means trusting them with access to your account. The safest version of this product is the one that never asks. Typing ten orders yourself takes about three minutes a week.

What a breach of our database would expose

What we hold	What an attacker would get
Your email address	Your email address. Real, but limited.
Your password	Argon2id hash — memory-hard, individually salted, impractical to crack in bulk.
Sessions	Hashes only. A stolen row cannot be replayed as a login.
Your two-factor secret	Stored unencrypted, so it would yield valid codes — but not a login without your password. Backup codes are Argon2id hashes. See known gaps.
Your recorded positions	Which tickers you said you bought and how much. Self-reported, and not linked to any account anywhere.
Anything that could touch your money	Nothing. It does not exist in our systems.

Worst realistic case: someone learns your email address and that you were tracking a handful of stocks. Unpleasant, not catastrophic. Use a password you use nowhere else and even the first part stays contained.

How your account itself is protected

Argon2id password hashing at 64 MiB memory cost — the current standard, and far harder to attack with GPUs than older schemes.
Optional two-factor authentication from an authenticator app, with single-use backup codes stored as Argon2id hashes. Never SMS — SIM-swap attacks make it the weakest option available.
Server-side sessions, stored hashed, revocable instantly. Not JWTs, which cannot be revoked before they expire.
Brute-force lockout per account and per IP address, with escalating delay.
CSRF protection on every action that changes anything.
Strict Content Security Policy with a fresh nonce per request, so an injected script cannot run even if markup escaping failed somewhere.
No third-party scripts at all — no analytics, no CDN, no fonts, no tracking pixels. Every byte of JavaScript is served by us and readable in one file.
Tamper-evident audit log: security events are hash-chained, so an entry cannot be edited or removed without breaking the chain.

What we track about you

Deliberately little, and never sold:

When you signed up and when you last signed in
Which weeks you looked at the list — recorded once per week, not per click
The positions you chose to record for tracking
A truncated IP address for rate limiting: the last octet of IPv4 is discarded. Enough to stop an attack, not enough to locate you.

Full detail in the Privacy Policy. Delete your account any time by emailing hello@nurbon.com and everything above goes with it.

Protecting yourself, generally

Nobody from this service will ever ask for an API key, a password, or a 2FA code. There is no feature that needs one. If you receive such a request — by email, chat, or a site that looks like this one — it is a phishing attempt. The real service has no field to put them in.

Use a unique password here, ideally from a password manager.
Turn on two-factor authentication at your broker. That is where your money actually is.
Check the domain before signing in.

Known gaps, stated plainly

Two-factor authentication, email confirmation, and password reset all exist now — turn 2FA on from your account page. What follows is what is still missing, or weaker than it sounds.

The brute-force lockout is per server process, not global. The failed-attempt counters live in the memory of whichever process handled your request, and this runs as short-lived serverless functions — several can be alive at once, and they are recycled often. So five failed attempts means five per process, and the count resets when a process does. Fixing it properly needs a shared store for the counters, which is not wired up. Argon2id hashing and 2FA are what actually stand behind your password; treat the lockout as a speed bump.
Your two-factor secret is stored in a form we can read. Encrypting it would need a key the server can also read, which anyone who reached the database would very likely reach too. So 2FA here defends against a stolen or reused password — the common case — and not against a breach of our own database. Your backup codes are Argon2id hashes; the secret itself is not.
An authenticator app is the only second factor. No passkeys. A six-digit code can be typed into a convincing fake page in a way a passkey cannot.
Whoever controls your mailbox can reset your password. That is true of every site with a reset link. Two-factor authentication is what stops the mailbox alone from being enough, which is the argument for turning it on.
The password check is thin. Twelve characters minimum and a short built-in list of obvious choices. There is no check against real breach corpora, so a password already leaked in someone else's breach will be accepted here. Use a password manager.
You cannot see or end your other sessions. Changing your password signs every other device out, and that is currently the only lever. There is no list of where you are signed in.
The audit log's chain is stored in the database it protects. Editing or deleting one entry breaks every hash after it, which catches casual tampering. It does not stop someone with full write access from recomputing the chain from the point they changed it. Nothing publishes the chain's head outside this system, so there is no independent copy to check it against.
You cannot read your own security log. The events are recorded and chained, but no page shows them to you. Until one exists, the log is something we can inspect and you have to take on trust.
Deleting your account is a manual request. Individual portfolios you can delete yourself, instantly. The account itself, and changing your email address, mean emailing hello@nurbon.com — actioned within 30 days. There is no button for either yet.
Our email provider sees your email address. Confirmation and reset messages go out through a third-party sending service, which necessarily receives the address in order to deliver to it. Our hosting and database provider holds the rest. Neither runs any code in your browser — "no third-party scripts" is a promise about this page, not about where the data sits. The full list is in the Privacy Policy.

None of these can move your money, because nothing here can. They are listed because a security page that names only its strengths is advertising.