Security Overview
Last Updated: 24 August 2026
1. Security is part of the product
Security is built into how Itoflow handles access, data, and account actions. We use layered controls to protect information, limit access, and keep sensitive actions under user control.
We review these controls as the product and threat environment change, with clear ownership for the safeguards we operate.
2. Protecting data and access
Access to Itoflow is authenticated, and information is protected while it moves and while it is stored. Access is limited to what is needed to operate and support the service.
Protected in transit: Connections to Itoflow use encrypted transport to protect data as it moves between you, Itoflow, and supported services.
Protected at rest: Sensitive connection data is kept in access-controlled, encrypted systems. For sensitive data encrypted at the application layer, Itoflow uses AES-256-GCM authenticated encryption.
3. Broker connections stay under your control
Each broker connection starts with your authorization. You can disconnect it at any time, and Itoflow uses connected-account access only for supported product functions.
Itoflow is not a broker or custodian and does not hold customer funds.
4. Live trading requires your approval
Live trades require your explicit approval before execution through a connected brokerage account. You remain responsible for transactions executed from your account.
Itoflow keeps decisions, proposed actions, and approval state visible so you can review what was proposed, what you approved, and what happened next.
5. Oversight, assurance, and reporting
We monitor service health and security signals so our team can investigate unexpected behaviour and respond when needed. We review access and controls as the product changes.
Our SOC 2 assurance work is in progress.
For legal and privacy terms governing use of the platform, see the Terms and Conditions and Privacy Policy.
Report a suspected security issue: [email protected]
Privacy inquiries: [email protected]
This page is a high-level overview and does not modify the legal terms of the service or make guarantees beyond the platform documentation and applicable agreements.