FolioBright is private by default and built to collect as little as possible. Your holdings — not your identity — are what we care about, and the most sensitive parts of your financial life stay on your device wherever we can keep them there.
A tool that sees this much of your financial life has to protect it just as seriously. Here is how we handle, and safeguard, your data.
FolioBright is private by default and built to collect as little as possible. Your holdings — not your identity — are what we care about, and the most sensitive parts of your financial life stay on your device wherever we can keep them there.
Every connection runs over HTTPS/TLS, and your synced data sits on infrastructure that encrypts it at rest. Nothing travels or rests in the clear.
Brokerage files are parsed in your browser and never uploaded — only the transactions inside them. Account numbers are stripped before your portfolio ever leaves your device. We never sell your data or run ads.
Passwords are hashed with bcrypt and screened against known breach databases — never stored in plain text. Prefer Google? We verify the token and never see your Google password.
Card details go straight to Stripe (PCI DSS Level 1) and are tokenized. FolioBright never sees or stores your card number.
Hardened HTTP security headers, rate-limited sign-in and data endpoints, and isolated managed hosting keep the service resilient against abuse and intrusion.
Export your holdings, transactions, and reports anytime as JSON or CSV. Ask us to delete your account and your data goes with it.
FolioBright is built on a small set of established providers, each independently audited to recognized standards. They handle their piece; we share only what is strictly needed:
• Render — application & database hosting (SOC 2 Type II)
• Stripe — subscription payments (PCI DSS Level 1, SOC 2)
• Microsoft 365 — transactional email delivery (SOC 2, ISO 27001)
• Twelve Data — market prices (server-side only; no personal data shared)
• Google — optional sign-in (only if you choose it)
Your account data runs on managed, redundant cloud infrastructure with automated daily backups, plus encrypted, offsite copies kept separately — so your portfolio can be recovered even in the unlikely event of a full outage. And you can keep your own copy at any moment with a one-click JSON or CSV export; your data is always yours to take with you.
Found a vulnerability or something that looks off? We genuinely want to hear about it. Email support@foliobright.com with the details and we will respond promptly. Please give us a reasonable chance to fix an issue before disclosing it publicly.
FolioBright is not yet independently SOC 2 audited on its own — our infrastructure and payment providers are, and formal certification is on our roadmap as we grow. If your organization requires it, tell us.
Add a few holdings or import a brokerage CSV, and your dashboard comes to life in minutes.