Security and compliance
Your financial data is encrypted, isolated and never sold. Here is how we protect it.
- AES-256 encryptionBank-level security
- GDPR compliantEU data protection
- CCPA compliantCalifornia privacy
- Privacy by defaultYour data stays private
How we protect your data
A multi-layered approach to keeping your financial information safe.
Bank-level encryption
All data is encrypted with AES-256, the same standard used by banks and financial institutions.
- Encryption in transit (TLS 1.3)
- Encryption at rest (AES-256)
- Encrypted database backups
Secure authentication
Industry-standard authentication powered by Supabase.
- Secure password hashing (bcrypt)
- Email verification required
- Session token management
Database security
Row-level security and data isolation keep your information private.
- Row-level security policies
- Multi-tenant data isolation
- Automated security updates
Secure infrastructure
Enterprise-grade infrastructure with redundancy and monitoring.
- Hosted on secure cloud infrastructure
- Regular security audits
- Continuous monitoring and alerts
Trusted third-party services
We work with providers that meet high security standards.
| Provider | What they do | Used for |
|---|---|---|
| Supabase | Enterprise PostgreSQL database with built-in security features and compliance certifications. | Authentication, database, storage |
| OpenAI | SOC 2 Type II certified AI provider with strict data handling and privacy policies. | AI models, API security |
| Finnhub | Secure financial data provider with enterprise-grade API security and reliability. | Market data, real-time quotes |
Compliance and data privacy
We comply with major privacy regulations to protect your rights.
Your data rights
You have complete control over your personal data. At any time, you can:
- Request a copy of all your data
- Modify or update your personal information
- Delete your account and all associated data
- Withdraw consent for data processing
- File a complaint with supervisory authorities
To exercise any of these rights, visit your account settings or contact us at privacy@heywarren.com.
GDPR compliance
European Union data protection
We comply with the General Data Protection Regulation for all users, regardless of location.
- Right to access your data
- Right to data portability
- Right to erasure
- Transparent data processing
CCPA compliance
California privacy protection
We comply with the California Consumer Privacy Act to protect California residents.
- Right to know what data we collect
- Right to delete personal information
- Right to opt out of data sales (we do not sell data)
- No discrimination for exercising rights
If something goes wrong
In the unlikely event of a security incident, this is the plan we follow.
Immediate detection and containment
Investigation and impact assessment
User notification within 72 hours
Remediation and prevention measures
Regulatory reporting if required
Keep your own account secure
- Use a strong, unique password
- Never share your login credentials
- Log out when using shared devices
- Keep your email account secure
- Report suspicious activity right away
Questions about security?
We are transparent about our practices and happy to answer anything before you connect an account.