Security practices

Account data, paper-trade records, and journal entries are stored on encrypted, access-controlled cloud infrastructure. Indian user accounts are pinned to the India region so that personal data and trading metadata stay within Indian data centres for primary storage. Backups are encrypted, region-bound, and rotated on a fixed schedule.

Broker connections use OAuth or token-based flows defined by the broker itself. You authenticate on the broker’s own login page; Reverge never sees, stores, or transmits your broker username, password, PIN, or TOTP secret. We hold only the short-lived access token the broker issues, and we refresh or revoke it on your behalf when you connect or disconnect.

All traffic between your browser, our servers, and broker APIs is protected with TLS 1.2 or higher. At rest, databases and backups are encrypted with AES-256. Broker tokens and secrets are stored in an isolated secrets store with per-record encryption keys, separated from general application data.

Sessions time out after a period of inactivity and are bound to the device that signed in. Two-factor authentication (2FA) for Reverge accounts is planned and will be offered as an opt-in when available. In the interim, we recommend using a strong, unique password and enabling 2FA on the email account linked to your Reverge login.

If you believe you have found a security vulnerability in Reverge, please report it to tech@revergepro.com. Include reproduction steps, affected endpoints, and the impact you observed. We acknowledge reports within two business days and ask that you give us a reasonable window to remediate before any public disclosure. We will not pursue legal action against researchers who act in good faith and within the scope of this policy.