Security and control
Vikayo is built around constrained access, server-side boundaries, and customer control. This page describes implemented safeguards—not certifications.
The implemented SnapTrade adapter reads supported account data. Vikayo cannot place trades. A production account has been verified with read-only synchronization. Brokerage availability varies by institution and account type.
Broker connection credentials are encrypted before storage and decrypted only in server-side synchronization flows.
User-scoped records use ownership checks and Supabase row-level policies where defined.
Provider, billing, and signing secrets stay outside browser bundles.
Stripe hosts payment collection; Vikayo validates signed webhook events and handles them idempotently.
User-scoped API operations verify the authenticated owner before acting.
Only data needed for portfolio intelligence and service operation should be retained; sensitive holdings are excluded from conversion analytics.
Connection controls support disconnection. Account deletion requests can be sent to support@vikayo.com.
Report suspected security issues to support@vikayo.com with enough detail to investigate safely.
SnapTrade, Stripe, market data, email, and push capabilities depend on provider configuration and uptime.
