Security at Midas Edge
Your financial data is sensitive. This page summarizes safeguards implemented in Midas Edge code and operations, and separates those controls from third-party provider responsibilities.
Security controls
Data Protection Controls
Current controls for financial data include:
- HTTPS/TLS for application traffic
- Encrypted Plaid access tokens before database storage
- Secrets loaded from managed environment/Vault configuration, not committed source
- Supabase/Postgres row-level security policies for user data isolation
No Credential Storage
Brokerage authentication is delegated to Plaid:
- Brokerage connections are initiated through Plaid Link
- We store encrypted Plaid access tokens, not brokerage usernames or passwords
- Midas Edge imports holdings and transaction data for analytics and does not initiate trades
- You can disconnect linked brokerage access through account or brokerage controls
Application and Infrastructure Controls
Midas Edge uses managed infrastructure plus application-level controls:
- Hosted on Vercel-managed application infrastructure
- Primary persistence in Supabase Postgres
- Responsible disclosure policy and security.txt contact published
- Structured audit logging for authentication, privacy, billing, and admin events
- System status is exposed separately without claiming an uptime SLA
Account Protection
Account controls are built around Supabase Auth and audit logging:
- Supabase Auth session management
- TOTP multi-factor authentication with backup codes and recovery cooldowns — enable it in Settings → Security
- Audit events for MFA, authentication, admin access, and privacy workflows
- User-visible account access log for administrative access sessions
Provider Dependencies
Midas Edge relies on managed providers for parts of the product. This list identifies integration roles only; it is not a claim that Midas Edge has completed external certifications, audits, or vendor DPAs for every provider, or that every AI request is routed through Vertex-only infrastructure.
Plaid
Brokerage data connectivity through Plaid Link
Supabase
Authentication and Postgres database
Vercel
Application hosting
Google Gemini / Vertex AI
AI processing through the configured Google provider; Vertex AI is preferred when environment configuration is present
Stripe
Payment processing
Financial Data Protection
As a platform handling portfolio and brokerage data, Midas Edge organizes safeguards around Gramm-Leach-Bliley Act (GLBA) Safeguards Rule categories.
GLBA safeguards self-attestation
Midas Edge self-attests that the code-backed controls listed below are the current safeguards program for customer portfolio and brokerage data. This implementation summary is a public self-assessment of implemented controls, not a SOC 2 report, independent audit, legal opinion, or statement that all provider DPAs and contractual work are complete.
Public evidence trail
These public artifacts describe the current user-visible control surface. Internal policies, runbooks, vendor contracts, and DPA status are not published on this page.
- Data use and provider disclosures: Privacy Policy
- Customer security obligations: Terms of Service
- Security intake: Responsible disclosure policy
- Operational status: System status
- Privileged access visibility: Account access log
- MFA status visibility: Security settings
- Administrative safeguards: Designated security contact, role-scoped administrative access, and audit logs for privileged workflows.
- Technical safeguards: Row-level security (RLS) at the database layer, encrypted Plaid tokens, MFA endpoints, user-visible MFA enabled/not enabled status with verified authenticator counts, and audit logging for administrative access.
- Physical safeguards: Physical data-center security is delegated to managed cloud infrastructure providers; Midas Edge does not operate its own data centers.
- Incident response: Published security contact, responsible disclosure policy, and audit trails for investigation.
Administrative access sessions are logged and visible to users in their account access log.
System Status
Public status information is available separately from security disclosures, including the local health probe and current launch-readiness components.
Responsible Disclosure
Found a security vulnerability? We appreciate responsible disclosure. Please report security issues to our security team.