Security and data handling

• The app and its database run on Hetzner Cloud servers in Germany.
• Screenshots and CSV imports are stored in Cloudflare R2.
• Database backups are kept for 14 days.

• Exchange API secrets are encrypted at rest with AES-256-GCM. The key is held only on the production server, never in the database.

• AI features (chat, insights, digests and journal search) send relevant trade and journal data to an AI provider when you use them.
• An organization's owner or admin can turn AI data sharing off in the organization's admin settings. While it's off, nothing from that organization is sent to an AI provider and the AI features don't run.

• An organization's owner can delete the organization from its admin settings. For 7 days the owner can restore it. After 7 days we permanently delete the organization's trading accounts, trades, journal entries, screenshots and imports.
• Backup copies age out within 14 days after that.

Security questions or a data request: security@alphajourney.app.