Security and control
Your Account Permissions Stay Explicit.
Vikayo is built around constrained access, server-side boundaries, and customer control. This page describes implemented safeguards—not certifications.
CONTROL INDEX
Documented safeguards · not certificationsACCESS
Account access
Permissions · ownership · disconnectionAccount-specific brokerage access
Tradier connects directly for account verification and supported approval-based orders; SnapTrade supports other compatible brokerages. Live submission requires enabled execution, an eligible account and approval of the exact order. Read-only connections remain read-only. Tradier sandbox paper orders use virtual funds and require approval of their exact terms. Brokerage availability varies by institution and account type.
Account ownership checks
User-scoped API operations verify the authenticated owner before acting.
Disconnect and delete
Connection controls support disconnection. Account deletion requests can be sent to support@vikayo.com.
DATA
Data boundaries
Storage · isolation · minimizationEncryption
Broker connection credentials are encrypted before storage and decrypted only in authorized server-side brokerage flows.
Row-level isolation
User-scoped records use ownership checks and Supabase row-level policies where defined.
Server-side secrets
Provider, billing, and signing secrets stay outside browser bundles.
Data minimization
Only data needed for portfolio intelligence and service operation should be retained; sensitive holdings are excluded from conversion analytics.
SERVICE
Service operation
Billing · reporting · availabilityBilling security
Stripe hosts payment collection; Vikayo validates signed webhook events and handles them idempotently.
Incident reporting
Report suspected security issues to support@vikayo.com with enough detail to investigate safely.
Provider availability
SnapTrade, Stripe, market data, email, and push capabilities depend on provider configuration and uptime.