Security

Encryption in transit

Every connection to sovereignhni.com is forced over HTTPS with HSTS (max-age=63072000), which means browsers refuse to ever talk to the domain over plain HTTP. Backend API calls between the frontend and the FastAPI server use the same TLS-protected channel.

Encryption at rest

Application data lives in a Postgres database hosted on Supabase (Frankfurt, EU), which encrypts storage at rest by default. Backups are encrypted on the same infrastructure. Sovereign HNI does not keep a second copy of your data anywhere else; the processors listed below receive data to perform a task, not to store your portfolio.

Authentication

Authentication is handled by Supabase Auth. We support email + password (minimum 8 characters) and Google sign-in. Apple sign-in is not yet available. Sessions are short-lived JWTs verified on every backend request — both HS256 (legacy projects) and ES256 via JWKS (current projects) are supported. Tokens are never logged or stored server-side beyond their natural verification.

Data isolation

Every row in every table is keyed by user_id. The backend validates the JWT on every request and only ever queries rows belonging to the authenticated user, and the database enforces row-level security policies on top. There is no shared workspace, no admin panel that can read user data, and no internal team-wide access.

Exchange, broker, bank and wallet integrations

All integrations are read-only. We request the minimum permission scope that lets us see balances and positions. We explicitly do not request withdrawal, transfer, or trading permissions. Even if our infrastructure were compromised, an attacker could not move your funds through any connected account because Sovereign HNI does not have that ability.

API keys and bank access tokens are stored encrypted (Fernet) in the database. They are only decrypted in memory during a sync run and are never written to logs. Wallet connections use public addresses only — we never ask for a seed phrase or private key. Interactive Brokers is connected through its read-only Flex Web Service: the token can only return the report you configured, never trade or transfer. Brokers connected through SnapTrade are signed in on the broker's own page; your password and 2FA never reach us. Every exchange and broker sync leaves our infrastructure from a single fixed IP address (5.75.170.180), so you can restrict your API keys to it — restricted keys never expire at Binance, OKX or Bybit.

Third-party services we use, and what each one sees

The full per-trigger detail (what is sent, and when) lives in section 5 of the privacy policy. In summary:

• Supabase — Postgres database and authentication (all account and portfolio data at rest, encrypted; Frankfurt)
• Render — backend FastAPI hosting (Frankfurt)
• Vercel — frontend hosting and edge CDN
• Anthropic — the AI behind Hermes, the Monitor desk and the Second Brain. Hermes chat sends your fullholdings and liabilities list with every message; the Monitor brief and the “From your Second Brain” feed are opt-in— off until you switch on “Automatic AI analysis”, and only then do they run when you open the Monitor tab (net worth, asset mix, top holdings, liabilities, tax residence, nationality, watchlist, goal / task / note titles); AI-written daily and weekly digests and the grading of the desk's forecasts sit behind the same switch; screenshot import, presence import, the citizenship desk and the Second Brain AI buttons send what you upload or ask when you use them. Not used to train models under Anthropic's commercial API terms.
• OpenAI — Whisper speech-to-text: the audio clip, only when you use the microphone or send a Telegram voice message (and only when the feature is enabled)
• Resend — email digests, only if you opt in: your digest address and the brief text including your net-worth movement
• Telegram — only if you link the bot: your chat id and the messages you exchange with Hermes, plus opt-in digests
• Sentry — error monitoring on both sides (crash reports, stack traces, page URL, browser type; a 10% sample of performance timings). We do not attach holdings or balances to error events and do not enable session replay
• CoinGecko and Yahoo Finance — price data (ticker symbols only, batched across all users, no account identifier)
• Google — Google News RSS search queries for your Monitor countries and Second-Brain-derived topics (no account identifier); YouTube players on the Monitor's Live TV
• Open-Meteo — weather for the capitals of your Monitor countries (no account identifier)
• CitizenX — citizenship-by-investment quotes, only when you request one (applicant details you enter; anonymous)
• Interactive Brokers — its Flex Web Service, only if you connect an IBKR account: your Flex token and query id, returning positions and cash
• SnapTrade — hosted broker sign-in, only for brokers you connect through it: it holds the broker session and sees which broker you use under an opaque id (never your email); we receive positions, balances and account names
• Plaid, Salt Edge, Lean — bank linking (US / EU / MENA), only for banks you connect; mempool.space, Shyft, Zerion, Alchemy, Hyperliquid, public chain RPC endpoints (or Infura / Helius when configured) and DeFi protocol APIs (Jupiter, Kamino and the like) — balances for wallet addresses you add
• Your own AI agent — only if you create an MCP access token: whatever it requests, within the scope you granted
• Stripe (when paid tiers launch) — payment processing; card details will never touch our servers

What we deliberately do not do

• We do not sell user data. Ever. To anyone. For any reason.
• We do not use your data to train AI models — ours or anyone else's.
• We do not run marketing or advertising trackers on the dashboard.
• We do not store exchange withdrawal credentials or any keys with write scope.
• We do not have a backdoor that lets staff read your data.
• We do not send your portfolio to any provider not listed above.

HTTP security headers

The frontend sets the following headers on every response:

• X-Content-Type-Options: nosniff
• Referrer-Policy: strict-origin-when-cross-origin
• X-Frame-Options: DENY (the dashboard cannot be embedded in an iframe by another site)
• Permissions-Policy denying camera, microphone, geolocation, and FLoC

Strict-Transport-Security (2-year max-age) is enforced at the hosting layer — Vercel sends the header on every HTTPS response by platform default — rather than being set by the application itself.

Reporting a vulnerability

If you believe you've found a security issue, please email admin@sovereignhni.com with a description and reproduction steps. We will respond within 72 hours and work with you on a coordinated disclosure timeline.