1. Data Classification and Handling
WiseWeb Studio LLC (d/b/a Option Wheel Logic) classifies data into the following categories:
- Public: Marketing content, public-facing documentation, and anonymized aggregate statistics.
- Internal: Application configuration, non-sensitive operational data, and anonymized usage analytics.
- Confidential: User email addresses, hashed passwords, trade journal entries, portfolio data, and subscription information.
- Restricted: OAuth tokens for brokerage connections, API keys for third-party services, and any data subject to regulatory requirements.
Confidential and Restricted data is stored exclusively in Supabase (our managed database provider), encrypted at rest, and is never logged to external systems or stored in plaintext. Brokerage OAuth tokens are stored by SnapTrade under their own security controls and are never transmitted to or stored by Option Wheel Logic.
2. Access Control and Privileged Access Management
Access to production systems is restricted to authorized personnel only:
- All user-facing access is authenticated via Supabase Auth using email/password with bcrypt hashing.
- Administrative access to the Supabase dashboard and Vercel deployment platform is restricted to the sole owner and protected by strong passwords and multi-factor authentication (MFA).
- Service role API keys (which bypass row-level security) are stored exclusively as environment variables in Vercel and Supabase edge function secrets — never committed to source code.
- Row-Level Security (RLS) is enforced on all Supabase tables so that users can only access their own data.
- Third-party API keys (Alpaca, SnapTrade, Anthropic, Stripe) are stored as server-side secrets and never exposed to the client.
3. Encryption of Data at Rest and in Transit
- In transit: All data transmitted between users and the platform is encrypted using TLS 1.2 or higher, enforced by Vercel (frontend) and Supabase (backend/API).
- At rest: User data stored in Supabase is encrypted at rest using AES-256, managed by Supabase's infrastructure on AWS.
- Passwords: User passwords are never stored — only bcrypt hashes are retained, managed by Supabase Auth.
- Tokens: OAuth tokens for brokerage connectivity are handled by SnapTrade and are not stored in Option Wheel Logic's database.
4. Vulnerability Management and Patch Management
- Application dependencies are reviewed regularly using automated tooling (npm audit) and updated promptly when security vulnerabilities are disclosed.
- The platform is built on managed infrastructure (Vercel, Supabase) that handles OS-level patching, network security, and runtime updates automatically.
- Edge functions run in Deno's secure sandbox with explicit permission grants — no filesystem or network access beyond what is declared.
- Code changes go through review before deployment to the production branch.
5. Incident Response and Disaster Recovery
In the event of a security incident:
- The incident will be assessed and contained as quickly as possible, including revoking compromised credentials or disabling affected services.
- Affected users will be notified within 72 hours of confirming a breach that affects their personal data, consistent with applicable law.
- Supabase provides automated daily backups of all database data, retained for a minimum of 7 days, enabling point-in-time recovery.
- Vercel maintains deployment history enabling rapid rollback of the frontend application to any prior release.
- Post-incident, a review will be conducted to identify root cause and prevent recurrence.
6. Physical Security
Option Wheel Logic operates as a cloud-native application with no on-premises servers or physical data center infrastructure. All computing infrastructure is hosted by Vercel and Supabase (AWS), both of which maintain SOC 2 Type II certification and enforce physical security controls at their data centers including biometric access, 24/7 surveillance, and environmental controls.
Corporate workstations used to develop and administer the platform are protected by full-disk encryption (FileVault/BitLocker), OS-level authentication, and automatic screen lock. Software is kept up to date with security patches applied promptly.
7. Vendor Risk Management
Option Wheel Logic relies on the following key third-party vendors, each selected for their security posture and compliance certifications:
- Supabase — Database, authentication, and edge functions. SOC 2 Type II certified.
- Vercel — Frontend hosting and CDN. SOC 2 Type II certified.
- SnapTrade — Brokerage OAuth connectivity. Handles brokerage credentials under their own security framework; Option Wheel Logic never receives or stores brokerage login credentials.
- Stripe — Payment processing. PCI DSS Level 1 certified. Option Wheel Logic does not store or transmit cardholder data.
- Anthropic — AI analysis features. Data submitted for AI processing is not used for model training.
Vendor security practices are reviewed when onboarding new providers and periodically thereafter. Vendors with access to user data are required to maintain appropriate security certifications.
8. Contact
To report a security concern or vulnerability, please contact us at support@optionwheellogic.com. We are committed to responding to all security reports promptly.