Security
Read-only. Encrypted. Yours.
Your journal holds trade history, screenshots and notes about how you think under pressure. This page lists the protections that are in place today — each one is something we built and can point at, not a badge we bought. Further down, we have written out what we deliberately do not claim.
GAPHYTORO Limited is a software company. We do not broker trades, hold deposits, manage trading accounts, provide investment advice, or execute trades for users.
Last reviewed 28 July 2026
What protects your account
Six protections you can check.
Read-only broker access
You connect with your broker’s investor — view-only — password. GAPHYTORO reads closed trades, open positions and balance. There is no path anywhere in the product to place, change or close a trade, and none to move money.
Connection details sealed with a managed key
Broker connection details are encrypted with AES-256-GCM under a key generated for that one connection, and that key is itself locked by Google Cloud KMS. The stored data is useless on its own — opening it needs a call to a key that lives outside the database.
Isolation enforced by the database
Access rules sit in the database itself, not only in the application. Every table carries row-level security, so one account cannot read another account’s rows even if the code above it asks for them.
Private screenshots and media
Chart screenshots and trade media are never public files. Each view is checked against your account first, then served through a link that expires shortly after it is issued.
Card details never reach us
Processed by Paystack — your card details never touch GAPHYTORO. Checkout hands you to the provider’s own secured page, and we keep only the result of the payment.
Where your data lives
The application and its database run in Google Cloud’s europe-north1 region in Finland, and the automated work behind them runs in Google’s European regions.
How we run it
The boring part.
Most of security is what happens behind the product: who can get in, what a credential is allowed to reach, and what gets recorded.
01Administrator access needs a real key
Reaching the admin console requires a passkey — a device- or hardware-bound credential that cannot be phished, forwarded or read out over the phone. The only fallbacks are an authenticator-app code and single-use backup codes stored purely as salted hashes. There is no email, SMS or chat-message code that bypasses any of it.
02Use of the encryption key is logged outside our systems
Every time a connection key is sealed or opened, Google Cloud records it in its own audit log — separate from our application, and not something the application can rewrite.
03The application runs with the least access it can
GAPHYTORO runs under its own restricted identity, scoped to exactly the resources it needs and nothing more. It is not a general-purpose account, so a problem in the application does not hand over everything around it.
04Internal automation proves who it is on every request
The automated work that imports your trades or sends your email authenticates with short-lived, Google-signed tokens. A token is accepted for one purpose at one address and refused everywhere else, so one compromised path cannot reach another.
05Encrypted in transit, and browsers are told to insist
Everything is served over HTTPS with strict transport security, so a browser that has visited GAPHYTORO once will refuse to load it over an unencrypted connection.
06Every change is checked on the way in and on the way out
Each proposed change is put through automated review — including a scan for credentials committed by accident and a full run of the test suite — and the release pipeline scans again before anything reaches production.
Responsible disclosure
Found something? Tell us.
Email support@gaphytoro.com with Security in the subject line. Describe what you found, how to reproduce it, and how you would like to be credited. If you would rather not use email, the contact page reaches the same people.
We do not run a paid bounty programme, so we cannot offer a reward. Please tell us anyway.
What we commit to
- We read every report, and a person will reply to you.
- We will not take legal action — or ask anyone else to — over good-faith research that follows the guidance below.
- We will tell you when it is fixed, and credit you publicly if you would like that.
What we ask of you
- Do not access, change or keep data that is not yours. If you can demonstrate the flaw with your own account, stop there.
- Do not degrade the service: no denial-of-service, no bulk automated scanning, no spam.
- No social engineering of our team, our customers or our suppliers, and no physical intrusion.
- Give us a reasonable chance to fix the issue before you publish it.
What we don’t claim
The badges we don’t have.
A security page is easy to fake. Ours is more useful if it also says where the gaps are, so you can decide what to trust us with.
No SOC 2, ISO 27001, PCI DSS or HIPAA certification
We have never been audited against any of them, so we do not display their badges.
No third-party penetration test to publish
Nobody outside the company has tested this platform on our behalf. When that changes, this page will say so and when.
No paid bug-bounty programme
We cannot offer a reward for a vulnerability report. We would still very much like to hear about it.
Not end-to-end encrypted
Your journal is encrypted in transit and your broker connection details are sealed with a managed key, but the product can read your trades. That is how review, analytics and market context work at all.
No two-factor sign-in for trader accounts yet
Passkeys and authenticator codes currently protect administrator access only. Extending that to every account is work we have not done.
No published uptime guarantee
We do not advertise an availability percentage, because we do not measure and report one yet.
No certifications or audit badges
When we say bank-level security we mean the controls listed above — not a certification. We hold no SOC 2, ISO 27001, PCI DSS or HIPAA attestation, and we will not display a badge we have not earned.
FAQ
Common questions.
Something we haven’t covered? Write to support@gaphytoro.com and a human will answer. Our privacy policy covers what we collect and why.
01Can GAPHYTORO trade on my account or move money?
No. Broker connections are read-only: GAPHYTORO reads trade history, open positions and balance, and nothing else. It cannot open or close positions, change orders, or withdraw funds. GAPHYTORO is journaling software, not a broker or an account manager.
02What happens to my broker credentials if your database is copied?
They stay unreadable. Each connection is encrypted under its own key, and that key is locked by Google Cloud KMS, which sits outside the database. A copy of the data alone is not enough to open it.
03Who can see my journal?
You. Your trades, notes, screenshots and psychology entries are scoped to your account by rules enforced in the database. Mentorship is built so a mentor sees only what you choose to share with them. We have not yet put that sharing model through independent testing, so we describe it as how the feature is built rather than as a guarantee.
04Are my screenshots and trade media public?
No. They are private files. Each view is authorised against your account and then served through a link that expires shortly after it is issued.
05Can I take my data with me, or have it deleted?
Yes. Write to support@gaphytoro.com from the email address on your account. Requests are identity-checked before anything is exported or removed.
06How do I report a security problem?
Email support@gaphytoro.com with “Security” in the subject line. Tell us what you found and how to reproduce it. We will reply, we will not pursue good-faith researchers, and we will credit you if you want us to.
Journal with confidence.
Connect read-only, keep review separate from execution, and control who can see your journal.