Security at Vestie
Your money and your personal information deserve serious protection. Vestie is built on infrastructure from some of the most trusted names in finance and technology, and we add our own safeguards on top. This page explains who holds what, how it is protected, and what you can do to keep your account safe.
1. Who Protects What
Vestie is an SEC-registered investment adviser. We don't hold your money ourselves. Each part of your account is handled by a provider that specializes in it:
- Alpaca Securities LLC (member FINRA/SIPC) holds your brokerage account, your cash, and your investments.
- Google Cloud and Firebase run sign-in, our database, and our document storage.
- Render hosts the Vestie website and the Vestie servers that talk to Alpaca and Plaid.
- Plaid securely connects your bank account so you can move money in and out.
Your brokerage account is protected by the Securities Investor Protection Corporation (SIPC) up to $500,000, including up to $250,000 in cash. SIPC protection covers losses from a broker failing. It does not protect against losses from market movements.
2. How Vestie Protects Your Data
Sign-in and passwords
- You can sign in with email and password, Sign in with Apple, or Google Sign-In. All sign-in is handled by Firebase Authentication.
- Your password is never sent to Vestie's servers and is never stored by Vestie. Firebase stores it only as a salted, one-way hash.
- Every request the Vestie app makes to our servers carries a signed sign-in token that expires after one hour. Our servers check that token on every request before doing anything with your account.
Your account data
- Database rules make sure that you, and only you, can read your account data. Every other record is locked by default.
- Sensitive fields, such as your brokerage account, deposits, withdrawals, and subscription status, can only be changed by Vestie's servers, never directly from the app.
- Account documents you upload can only be read by you.
- Archived or deleted accounts are blocked from accessing account data.
Your Social Security number
- Your Social Security number is masked on screen as you type it.
- It is sent over an encrypted connection to Alpaca, which needs it by law to open a brokerage account.
- Vestie does not store your full Social Security number.
Encryption
- All traffic to vestie.com and the Vestie app is encrypted with TLS (HTTPS). Our website tells browsers to only ever connect over HTTPS.
- Data stored in our database and file storage is encrypted at rest by Google.
Keys, payments, and analytics
- The keys we use to talk to Alpaca and Plaid live only on our servers. They are never included in the website or the app.
- App Store purchases are verified using data signed by Apple. Website payments are processed by Stripe, so Vestie never sees your full card number.
- We never send bank account numbers, routing numbers, Social Security numbers, government IDs, or brokerage documents to analytics or advertising tools. When we record how the app is used to fix bugs, anything you type into a form is masked before it leaves your device. See our Privacy Policy for details.
When you delete your account
When you delete your Vestie account, we disconnect your linked bank through Plaid and remove the stored bank connection, in addition to the data deletion described in our Privacy Policy.
3. Brokerage and Custody: Alpaca
Your brokerage account, cash, and investments are held by Alpaca Securities LLC. Alpaca describes its security program as follows.
Compliance
- Alpaca follows the ISO 27001:2022 standard.
- Alpaca undergoes an annual SOC 2 Type 2 audit covering all five trust services criteria: Security, Confidentiality, Availability, Processing Integrity, and Privacy.
- Alpaca complies with GDPR and the UK ICO data protection program for personal data it collects and stores.
Infrastructure
- Alpaca runs on Google Cloud Platform, which holds ISO 27001, SOC 1, SOC 2, and PCI DSS certifications and is GDPR compliant.
- Alpaca uses a Zero Trust architecture, which means every attempt to reach its network, applications, or data is verified, no matter where it comes from.
- Access to Alpaca's infrastructure requires strong credentials and two-factor authentication, and access is reviewed regularly so only authorized staff have it.
- Alpaca takes full backups every day, stores them offsite, and tests them daily to make sure they work.
Data handling and encryption
- Confidential data is encrypted at rest with AES-256 and in transit with TLS.
- Data is classified by sensitivity, and confidential data gets the highest level of protection.
- Strict role-based access controls limit who can see confidential data.
- Alpaca staff are trained on handling confidential data.
Learn more on Alpaca's security page.
4. Infrastructure: Google Cloud and Firebase
Vestie's sign-in, database, file storage, and background jobs run on Firebase, which is part of Google Cloud.
- All Firebase services have completed ISO 27001, SOC 1, SOC 2, and SOC 3 evaluations. Many have also completed ISO 27017 and ISO 27018 certification.
- Firebase encrypts data in transit with HTTPS and keeps each customer's data logically isolated.
- Cloud Firestore, Firebase Authentication, Cloud Functions, and Cloud Storage also encrypt data at rest.
- Google Cloud's infrastructure is secure by design and holds certifications including ISO 27001, SOC 1, SOC 2, SOC 3, and PCI DSS.
- Firebase Authentication uses signals such as IP address to help detect and block abuse during sign-up and sign-in.
Learn more on Firebase's privacy and security page and the Google Cloud Compliance Resource Center.
5. Hosting: Render
The Vestie website and the servers that connect your account to Alpaca and Plaid are hosted on Render.
- Render is ISO 27001 certified.
- Render completes SOC 2 Type 2 audits covering security, confidentiality, and availability.
- Render offers a GDPR data processing agreement and is certified under the EU-US Data Privacy Framework.
- Render runs a public vulnerability disclosure program with HackerOne.
Learn more on Render's security page.
6. Bank Connections: Plaid
- When you link a bank, you sign in to your bank through Plaid. Vestie never sees or stores your bank username or password.
- Plaid gives Alpaca a secure token for moving money, so your bank login is never shared with Alpaca either.
- Plaid connects accounts using encrypted APIs and monitors its systems 24/7.
- You can stop sharing at any time by disconnecting your bank in Vestie or through Plaid Portal.
Learn more on Plaid's safety page.
7. Reporting a Vulnerability
We welcome reports from security researchers. If you think you've found a security issue in Vestie, email hey@vestie.com with the subject line "Security report." Please include enough detail for us to reproduce the issue, and give us reasonable time to fix it before sharing it publicly. Please don't access other people's data, disrupt the service, or run automated scans that degrade it.
If the issue is in Alpaca's platform, you can also report it to bugreport@alpaca.markets to be considered for Alpaca's bug bounty program.
8. Keeping Your Account Safe
Security works best when we do it together. You can help by:
- Using a unique password for Vestie, or signing in with Apple or Google.
- Turning on two-factor authentication for your Apple Account, Google account, and email, since those protect your access to Vestie.
- Never sharing your password or sign-in codes with anyone. Vestie will never ask for your password by email, text, or phone.
- Watching for phishing. Scammers send fake emails, texts, and calls designed to trick you into sharing personal details.
- Keeping your phone and computer updated and using anti-malware software.
- Being wary of investment scams that promise high returns with little risk. These often show up on social media and messaging apps, and some use the names of real companies.
- Checking the address. Vestie's website is vestie.com, and our iOS app is published by Vestie on the App Store. Anyone asking you to sign in to "Vestie" on a different website is almost certainly not us.
9. If You Think You've Been Scammed
- Email us right away at hey@vestie.com and change your Vestie password.
- Contact your bank and any other financial institutions you use.
- Scan your devices for malware.
- Watch your credit report for anything unusual.
- Report it to the FTC at reportfraud.ftc.gov and consider filing a police report.
No system is completely secure, and we can't guarantee absolute security. We keep improving our safeguards as new threats appear.