Security
Last updated: 4 November 2026.
How we protect the site and your account, how to stay safe from people pretending to be us, and how to report a weakness.
How we protect the site
- HTTPS everywhere, with HSTS and a strict content security policy. The site cannot be embedded in other websites.
- Free tools work in your own browser; your trading data is not sent to us.
- Accounts: one-time email codes instead of passwords, optional 2-step sign-in with an authenticator app, a fresh code before sensitive changes (email, phone, deleting the account, billing), and database rules so each person can read and change only their own records.
- Uploads: encrypted in transit, processed on our own server, the file deleted right after the run and results within 24 hours (see uploads).
- Forms are limited to the fields we need, rate-limited, and collected from our host promptly.
- Our server uses a firewall, key-only access, intrusion blocking and regular security updates, and the site is checked automatically for unexpected changes.
No system is perfectly secure. If a breach is likely to harm you, we will tell you and the regulator, as the law requires.
Protect your account
- Turn on 2-step sign-in in your Profile where it is offered.
- Use a strong password and two-step sign-in on your email account too, because sign-in codes are sent there.
- Never share a sign-in code. We will never ask you for it.
- Sign out on shared devices, and use ‘Clear my data on this device’.
Stay safe from scams
Trading Checkup will never message you first asking for money, never asks for passwords, one-time codes or card numbers, and never offers trading tips, signals or “guaranteed” returns. Anyone who does this while using our name is not us: please tell us.
Report a security problem
Email hello@tradingcheckup.com with the subject “Security” and the steps to reproduce it. Please do not access other people's data, do not disrupt the site, and give us reasonable time to fix it before you share details. We acknowledge within 3 business days and keep you updated. Our contact details are also in security.txt.