Security at EarlySignal

Registration verifies email before account setup is completed. Passwords are hashed with Argon2id. Optional authenticator-based two-factor authentication includes recovery codes, and the application supports encryption of authenticator secrets, session revocation, and additional verification for sensitive actions. Use a unique password, protect recovery codes, and review available session controls.

The application checks account ownership and current sharing permissions, validates inputs, checks the origin of state-changing requests, applies a Content Security Policy and other response headers, and records security-relevant events. Production request limiting uses Upstash, with limited fallback behavior for some page requests. Effectiveness depends on deployment configuration, provider availability, and ongoing operation; these controls are not a guarantee that every attack or error will be prevented.

EarlySignal is operated by Michael Amato, a sole proprietor based in New York, USA. Authorized operational access and service-provider processing are necessary to run the Service. Private journal data is not end-to-end encrypted against access by EarlySignal. This overview does not claim SOC 2, ISO, regulatory certification, an independent penetration test, or insurance coverage.

Fixed-precision financial storage, transaction-based updates, source provenance, import previews, validation, and duplicate/conflict checks help preserve trading records. Imports and calculations can still be incomplete or wrong. Review imported executions and analytics against original broker records and keep independent copies.

Smart Import can send file structure and bounded samples to the configured AI provider. Research question translation can send questions, clarification answers, and selected account labels and options. CSV filtering is not a guarantee of complete redaction. Requesting disabled response storage is not zero provider retention. See the AI privacy disclosure and analysis limitations.

Broker synchronization uses EarlySignal Connect and Trade It for account, holding, and trade-history retrieval. EarlySignal’s synchronization operations do not place, change, or cancel trades. Review the actual permissions displayed by the provider and use provider controls to revoke access when needed. Disconnecting and deleting a Tracker account are different operations; separately stored connection records need separate attention.

Stripe hosts payment entry and billing management. Trade screenshots are delivered through application routes that check current access and use database storage or a separately configured private object store. Community profile and banner images instead have public media URLs and long-lived caching. Removing access cannot recall copies already obtained by recipients. See the sharing disclosure.

CSV and JSON exports and, where configured, queued journal/screenshot archives provide different portability options. They are not complete system backups. Database recovery depends on the operator’s actual backup configuration and restore procedures; this page promises no fixed backup frequency, recovery time, or guaranteed restoration. Deleted objects can remain until asynchronous cleanup, and billing, trial, provider, log, backup, or recipient records can outlast deletion. See retention and account deletion for details.

Email support@earlysignal.co or michael@earlysignal.co with the affected feature, approximate time, and enough detail to understand or reproduce the issue. Do not include passwords, tokens, recovery codes, or unrelated personal data. For research, use accounts and data you control; do not access others’ information, disrupt the Service, or publish exposed personal information. We will investigate reports and meet applicable incident-notification duties. This is not a bug-bounty offer or a promise of a particular response deadline or legal safe harbor.