Security at The Investment Analyst

Protecting your data and your learners' data  is fundamental to how we build. This page summarises the security and privacy practices behind our learning platform and analytics products.

Encryption: All traffic is served over TLS 1.2+ with HSTS, so data in transit is always encrypted. Data is stored on managed cloud infrastructure that encrypts data at rest, and secrets live in a managed secret store — never in source code or logs.

Access control: Access to production systems follows least privilege; administrative endpoints fail closed (no access without valid credentials). Each learner's data is gated by a signed, per-user token, so one learner cannot access another's information. Access is tied to named identities and reviewed regularly.

Audit logging: We keep an append-only audit trail of security-relevant actions (administrative access, authentication events, data-subject requests). Application logs are structured and redacted — secrets and tokens are never written to logs.

Secure development: Every change ships through peer-reviewed pull requests with automated tests and security checks that must pass before release. The production branch is protected, and dependencies are continuously scanned, with high-severity findings blocking release.

Your data & privacy: We support access and deletion of personal data on request, with a documented retention policy. We do not sell personal data. Where we use AI features we send only de-identified information, and your data is not used to train third-party models.

Compliance: We are building toward SOC 2 Type II and have implemented the underlying controls, mapped to the AICPA Trust Services Criteria. For enterprise security reviews, please get in touch.

Reporting a security issue: Email support@theinvestmentanalyst.com with details. We aim to acknowledge within two business days.