How Coincruze handles your account and your data.

Your money is not with us.

This is the control that matters most, and it is structural rather than something we implement well or badly. Coincruze is not a broker and does not hold customer money. Your cash and securities sit in your own Interactive Brokers account, in your name, the entire time. There is no Coincruze account for your money to be in.

The consequence is worth stating plainly: there is no state this application can get into, and no compromise of it, that moves your assets somewhere else or makes them ours. The worst outcome of a failure here is that nothing happens to your portfolio.

What broker access we hold.

You authorise the connection at Interactive Brokers, on their site, not on ours. We never see your broker username or password. What we store is the token that authorisation returns.

What that access is used for

Reading your positions and available cash, and placing orders that have already passed your own rules. That is the whole list.

What it cannot reach

The connection is used only to read positions and place orders. It does not withdraw money, transfer assets to another account, change your broker settings, or open new accounts.

How to revoke it

Disconnect from your dashboard at any time. The stored token is deleted, the scheduled cycles stop running against your account, and your holdings are untouched. You can also revoke the authorisation from the Interactive Brokers side, which works regardless of anything we do.

Account security.

Passwords

Passwords are hashed with bcrypt at a cost factor of 12 and are never stored in plaintext. We cannot recover your password, only reset it. A complexity rule is enforced at signup.

Email confirmation

A new account is not active until the email address is confirmed, so an address you do not control cannot be used to register in your name.

Sessions

Session cookies use Rails' encrypted cookie store: they are signed and encrypted, so they cannot be read or altered in the browser.

Sign in with Google or Apple

Available as an alternative to a password. Authentication happens at Google or Apple and we receive only the identity they return.

Data and storage.

While Coincruze is pre-launch, the only personal data collected from the public site is an email address for the waitlist, together with the date you consented to updates. That is described in full in the privacy policy.

Application traffic is served over HTTPS. Coincruze has no production deployment yet, so any statement about transport versions, header policies or hosting arrangements would be a description of an environment that does not exist. Those will be documented here when there is something to document.

What is not in place yet.

This section exists because the previous version of this page listed several of these as though they were already built. They are not, and a customer deciding whether to trust this product should be able to see the gap.

• Two-factor authentication. There is no second factor on accounts today. No authenticator app, no SMS, no passkeys or biometrics.
• Encryption of stored broker tokens. The Interactive Brokers token is currently stored without application-level encryption. This is a known gap and is tracked for launch.
• An independent security assessment. No penetration test or third-party audit has been carried out. We will say who did it and when it happened, rather than displaying a badge.
• A production environment. Coincruze does not have one yet. Nothing on this page describes a live system serving customers, because there is not one.

None of these will be enabled quietly. When a control lands, this page changes in the same release and the date at the top moves.

Reporting a vulnerability.

If you find a security problem, tell us before you tell anyone else and we will not take action against you for reporting it in good faith. Email security@coincruze.com with enough detail to reproduce the issue.

We do not currently run a paid bug bounty. We would rather say that than imply one exists.