Portfolio Data Security
Your financial data security is our top priority. Here’s how we protect your portfolio information.How We Handle Your Data
Brokerage Connections
When you connect a brokerage:- Credentials are never stored - We don’t save your brokerage password
- Secure authentication - Industry-leading secure connection service
- Read-only access - We can only view holdings, never make trades
- Encrypted connections - All data transmitted securely
Secure Connection Service
Our secure connection service links your brokerage to Rallies:- Used by thousands of financial apps
- Bank-level security
- SOC 2 Type II certified
- Never shares your credentials with us
Data Encryption
All portfolio data is encrypted:| Layer | Encryption |
|---|---|
| In transit | TLS 1.3 |
| At rest | AES-256 |
| Backups | AES-256 |
What We Can See
After you connect your brokerage, we can see:- ✓ Stock/ETF/fund holdings
- ✓ Number of shares
- ✓ Current market value
- ✓ Cost basis (if your brokerage provides it)
- ✓ Recent transactions
What We Cannot Do
Rallies cannot:- ✗ Make trades in your account
- ✗ Transfer money
- ✗ See accounts you haven’t connected
- ✗ Access your brokerage password
- ✗ Share your data with third parties (without consent)
Manual vs. Connected Portfolios
| Manual Entry | Brokerage Connection | |
|---|---|---|
| Data | You enter holdings | Synced automatically |
| Security | No credentials needed | Bank-level encryption |
| Updates | Manual | Automatic |
| Risk | None | Minimal (read-only) |
Your Control Over Data
You can:Disconnect Anytime
- Go to Portfolio → Connected Accounts
- Click “Disconnect”
- Connection is removed immediately
- Historical data can be kept or deleted
Delete Your Data
- Go to Settings → Privacy
- Click “Delete Portfolio Data”
- All portfolio information is removed
Download Your Data
- Go to Settings → Privacy → Download Data
- Receive a copy of all your portfolio data
- Learn more →
Our Security Practices
Infrastructure
- Hosted on secure cloud infrastructure
- Regular security audits
- Penetration testing
- 24/7 monitoring
Access Controls
- Employee access is strictly limited
- Multi-factor authentication required
- Activity logging and monitoring
- Background checks for team members
Compliance
- GDPR compliant
- CCPA compliant
- SOC 2 practices
Incident Response
If a security incident occurs:- Immediate containment - Stop the breach
- Investigation - Determine scope and impact
- Notification - Inform affected users promptly
- Remediation - Fix vulnerabilities
- Review - Prevent future incidents