Skip to main content

Security

Last updated: October 31, 2026

Our commitment to security

This page lists what EarningsNerd's code, and the providers that host it, do to protect your account and your data.

Data protection

How your data is protected:

  • Encryption in transit: Pages and API calls travel over HTTPS (TLS), which Vercel provides for the site and Google Cloud Run for the API. The API also tells browsers to reach it only over HTTPS for a year (HSTS).
  • Encryption at rest: The database runs on Google Cloud SQL, which encrypts the data it stores by default.
  • Passwords: Passwords are stored only as hashes, never as the passwords themselves: a new or changed password as an Argon2id hash, and one set before we adopted Argon2id as its bcrypt hash until it is changed. When you set a password, we ask Have I Been Pwned whether it has appeared in a data breach, sending only the first five characters of its SHA-1 hash, and refuse one that has; when the service cannot be reached, the password is accepted.
  • Database access: The API reaches the database through Cloud Run's built-in Cloud SQL connection, which needs a Google Cloud service account granted access, and the database password is kept in Google Secret Manager. A scheduled job exports the database to a private Google Cloud Storage bucket on the first of each month.
  • Your account's data: The API serves your profile, watchlist, alerts, saved summaries and billing only to your logged-in session. Search, company pages and the summaries already generated are open to everyone.

Authentication and access control

How you log in, and what each account can reach:

  • Sessions: Your session is a signed token (a JWT), which the site keeps in an HttpOnly cookie sent only over HTTPS. The login and refresh responses also return the token in their body, and the API accepts it as a bearer header; the site's own code neither stores nor sends that copy.
  • Token renewal: The session token expires after 30 minutes and is renewed from a refresh token that lasts 30 days. Each renewal replaces the refresh token with a new one, and refresh tokens are stored only as hashes.
  • Access: Administrator tools need an administrator account, and the API checks Pro features against your plan.
  • Logging out: Logging out revokes the refresh token your browser sends with it. Logging out of all devices, from your account settings, revokes every refresh token your account holds at that moment, and so does changing or resetting your password. None of these revokes a session token already issued.
  • Failed logins: Ten failed logins for one email address, each within 15 minutes of the last, block password logins for that address for 15 minutes.

Payment security

Payments go through Stripe Checkout, on Stripe's own pages, so your card details never reach EarningsNerd's servers. We keep Stripe's references to your subscription and payments, with their amounts, dates and status. Stripe is certified to PCI DSS Level 1.

Infrastructure security

Where EarningsNerd runs, and how it is kept current:

  • Hosting: The site runs on Vercel. The API and its scheduled jobs run on Google Cloud Run, and the database on Google Cloud SQL, in Google Cloud's us-west1 region.
  • Updates: Dependabot checks the site's and the API's dependencies, and the build's own GitHub Actions, for updates every week.
  • Monitoring: Errors from the site and the API are reported to Sentry, and can carry your internal account id when you are logged in. The site's reports leave out cookies, request bodies and URL query strings, and Sentry records no session replays.

Application security

How the code guards against common attacks:

  • Input validation: The API checks request bodies against schemas (Pydantic), and database queries take your input as bound parameters (SQLAlchemy), not as SQL text.
  • Cross-site requests: The session cookies are set SameSite=Lax, so a browser does not send them with another site's form posts or background requests.
  • Framing: The site sends X-Frame-Options DENY and a Content-Security-Policy of frame-ancestors 'none', so other sites cannot show its pages in a frame. The API's responses under /api carry a Content-Security-Policy of default-src 'none'.
  • Rate limits: The API caps how often logins, new accounts, password-reset and verification emails, summary generation, questions, filing-text searches and the contact, feedback and waitlist forms can be used. Each API server keeps its own count.
  • Code checks: Automated checks scan the API's code for common security mistakes (Bandit), check the site's and the API's dependencies for known vulnerabilities (npm audit and pip-audit), and scan the repository for committed secrets (gitleaks).

Data privacy and compliance

What you can see and control:

  • The Privacy Policy says what we collect and why
  • You can export the records available through that feature and delete your account from your account settings; the Privacy Policy explains records that can remain
  • Registrations, logins, failed logins, logouts, data exports and account deletions are written to an audit log, and so are administrators' invites and feedback status changes

For more information about how we handle your data, please see our Privacy Policy.

Incident response

If a security incident happens:

  • A written runbook covers containing it, finding what it touched, gathering evidence and rotating keys
  • When the law requires it, we notify the users affected and the data protection authority

Best practices for users

You can help protect your account by following these security best practices:

  • Use a strong, unique password for your EarningsNerd account
  • Never share your password with anyone
  • Log out of your account when using shared or public computers
  • Keep your browser and operating system up to date
  • Be cautious of phishing attempts and verify the URL before entering credentials
  • Report any suspicious activity or security concerns to us immediately

Responsible disclosure

If you discover a security vulnerability in our platform, we encourage responsible disclosure. Please report security issues privately so they can be addressed before public disclosure. The aim is to reply within 2 business days.

To report a security vulnerability:

  • Email us at security@earningsnerd.io
  • Provide detailed information about the vulnerability, including steps to reproduce
  • Allow us reasonable time to address the issue before public disclosure
  • Do not access or modify data that does not belong to you

We appreciate the work of security researchers and will acknowledge responsible disclosures.

Third-party services

These providers do part of the work:

  • Stripe: PCI-DSS Level 1 certified payment processing
  • Resend: Sends account and alert emails
  • DeepSeek: AI provider powering summaries and Ask this Filing. Selected filing and financial information is sent for analysis; filing questions and recent conversation text are also sent. Personal information in that text is not automatically removed.
  • Sentry: Error reports, as Monitoring above describes
  • PostHog: Usage statistics: PostHog in your browser runs only after you allow analytics, and records sessions only if you allow that too

The service also records how accounts use it, such as sign-ups, plan changes, payments, feedback and feature use, against your internal account id, to run and improve it. This does not depend on your analytics choice.

Contact us

If you have questions about our security practices or need to report a security concern:

← Back to Home