Sign-in and access
SignalzIQ has no separate password. You sign in with your Google account through Cloudflare Access, which checks your identity before any request reaches the application. The application then validates the Cloudflare Access token on its side as well.
When your session ends, the app clears private data from the browser and returns you to sign-in instead of leaving private information on screen.
Brokerage connections (Plaid)
You can optionally import holdings from a brokerage or retirement account through Plaid, a service used by many financial apps.
- We never see your brokerage password. You log in to your institution inside Plaid’s own window. SignalzIQ receives only an access token.
- Read-only. The connection requests Plaid’s Investments product only. It cannot move money, make payments or place trades.
- Encrypted. The access token is encrypted with AES-GCM, bound to your account and that connection, and never returned to any browser.
- Private to you. Imported holdings are visible only in your account and are never shared with other users.
- Disconnect anytime. Remove a connection from Account settings. You can also revoke access from your institution or through Plaid.
API keys you add
Some optional features use API keys that you supply, such as your own OpenAI key for AI-written research summaries. Keys are encrypted at rest and never displayed again after you save them. You can replace or delete them at any time.
Data isolation
Watchlists, portfolios, connected accounts and settings are scoped to your account. Shared data is limited to public market research, such as company filings and prices, which is the same for everyone.
Infrastructure and backups
- The application is reachable only through Cloudflare, and every route except a health check requires authentication.
- Database backups are encrypted before they leave the application server, and the encryption key is never stored with the backups.
- Credentials and secrets are kept out of source code, logs and backups.
This website
The public site at signalziq.com is static. It runs no scripts, sets no cookies, includes no trackers or third-party fonts, and enforces a strict Content Security Policy.
Reporting a vulnerability
If you believe you’ve found a security issue, email support@signalziq.com with “Security” in the subject line. Please give us a reasonable chance to fix it before disclosing it publicly. Our security.txt lists the same contact.