Security Architecture & Data Protection

1. Client-Side Sandboxing

The safest data is data that is never sent to our servers. All foundational calculators, retirement decumulation models, and scenario stress tests execute entirely inside your local browser JavaScript engine. Your specific financial figures remain on your device unless you explicitly authenticate and choose to sync a portfolio to your account vault.

2. Cryptographic Security Standards

AES-GCM-256 Encryption

Registered user email addresses are encrypted at rest using authenticated AES-GCM-256 with distinct per-record 96-bit nonces, ensuring plaintext emails are never exposed in our database.

PBKDF2 Password Derivation

User passwords are salted and derived with PBKDF2 using SHA-256 and 100,000 iterations. We never store or transmit plaintext passwords.

Hashed Session Tokens

Session cookies are cryptographically hashed using SHA-256 prior to storage in Cloudflare KV and D1, eliminating plain session token exposure even in database dumps.

3. Network & Browser Security Headers

Basic Investor enforces strict modern browser security standards across all endpoints:

Strict-Transport-Security (HSTS): Enforces modern TLS encryption with a 1-year duration and subdomain inclusion.
X-Frame-Options: Strict DENY policy preventing clickjacking or iframe embedding attacks.
Cross-Origin Isolation: Strict same-origin opener and resource policies preventing speculative side-channel attacks.
CSRF Origin Guards: All state-changing API endpoints enforce origin verification.

4. Payment Security

Basic Investor does not process or store credit card numbers, CVVs, or bank credentials. All billing is processed directly through Stripe, a certified PCI-DSS Level 1 service provider.

5. Vulnerability Disclosure

We welcome responsible disclosure from security researchers. Please review our security.txt or contact our security team directly at [email protected].

Security architecture & data protection.