Built with security and privacy at the foundation.
AlphaLab follows the SOC 2 Trust Services Criteria and the ISO/IEC 27001 information security framework. This page documents the controls we have in place. We are committed to formal third-party audits; until those are complete, the descriptions below reflect our current practices, not a certified attestation.
SOC 2 Trust Services Criteria
SOC 2 evaluates a service organization's controls against five categories. Here is how AlphaLab addresses each one.
Security
Access controls, authentication, and network protection guard against unauthorized access. Row-level security isolates every user's data; admin-only operations require an admin role.
Availability
The Service runs on a managed cloud platform with monitoring and incident response. We aim to maintain service availability and communicate promptly during outages.
Processing Integrity
Simulated trades, backtests and risk calculations follow documented logic. Market data is clearly labeled as delayed and third-party-sourced; we do not represent simulated results as actual trading.
Confidentiality
User-uploaded files are stored in private storage with signed, time-limited access URLs. Data in transit is encrypted via TLS. Strategies and positions are walled off from other users.
Privacy
Our Privacy Policy details what we collect, how we use it, retention periods, and your rights under CCPA, GDPR and similar laws. Users can delete their account and data at any time.
ISO/IEC 27001 alignment
ISO 27001 is the international standard for information security management. Our controls map to its Annex A themes as follows.
Information security policies
These policies — Terms, Privacy, Risk Disclosure, Cookie Policy and this Security page — are versioned, dated, and presented to users for acceptance.
Access control
Authentication is managed by the platform's auth backend. Row-level security enforces per-user data isolation. Admin-only routes and operations are gated by role checks.
Cryptography
All traffic is encrypted in transit using TLS. Uploaded files are stored privately and accessed via signed URLs. We do not store full payment card numbers — our payment processor (Stripe) handles card data directly.
Operations security
Scheduled workflows, open-order processing and data refresh jobs run on the managed platform with logging. Errors in backend functions are logged for diagnosis.
Communications security
Email is sent through the platform's managed email service. Verification, password-reset and notification emails use token-based flows that do not expose credentials.
Supplier relationships
We rely on a managed app platform for hosting, a payment processor for billing, and third-party providers for market data and AI. Key subprocessors are listed below.
Information security incident management
We monitor for anomalies and investigate reported issues. In the event of a personal-data breach, we notify affected users and regulators as required by applicable law, including within 72 hours where the GDPR applies.
Compliance
We comply with applicable U.S. state privacy laws (CCPA/CPRA and others), the GDPR and UK GDPR, and other international privacy laws as outlined in our Privacy Policy.
Key controls at a glance
Encryption in transit & at rest
TLS for all traffic. Private storage for uploaded files with signed access URLs.
Data isolation
Row-level security ensures no user can see another user's strategies, trades or watchlists.
Access control
Platform-managed authentication. Admin-only operations gated by role. No shared accounts.
Data retention & deletion
Users can delete their account and data at any time. We delete or de-identify personal data within 30 days.
Subprocessors
We rely on the following categories of third-party providers to operate the Service.
Reporting a vulnerability
If you believe you have found a security vulnerability, please email us with the details so we can investigate and fix it. Do not publicly disclose the issue until we have had a chance to respond.
veritas73@gmail.comThis page describes AlphaLab's security practices and alignment with the SOC 2 and ISO/IEC 27001 frameworks. It is not a certification, attestation report, or Statement of Applicability. Formal SOC 2 Type II and ISO 27001 certifications require third-party audits that are planned but not yet completed. For legal obligations, our Terms and Privacy Policy govern.