Security

ArbEdge is a read-only market intelligence platform. We have no access to your trading accounts, exchange credentials, or funds. Here is exactly how we protect the data we do handle.

ACTIVE SECURITY MEASURES
Encrypted Connections
ACTIVE
Every connection between your browser and arbedge.app or api.arbedge.app uses HTTPS. Browsers are told to refuse unencrypted connections (HSTS).
Accounts Handled by Clerk
ACTIVE
Sign-in is run by Clerk, a dedicated authentication provider. If you sign in with Google, we never see your password. Admin pages are restricted to the site owner's verified account.
Hardened Web and API
ACTIVE
Security headers on every page, rate limits on public endpoints, strict validation of email addresses, and admin keys kept out of web addresses. Alert webhooks are only ever sent to public https addresses, never to private networks.
Verified Email Alerts Only
ACTIVE
The email list starts only after you confirm your address from your own inbox, and account alerts go only to the account's verified email, so nobody can sign someone else up. Every alert email has a one-click way to stop it.
Hosted on Railway
ACTIVE
ArbEdge runs on Railway's managed infrastructure, behind Cloudflare.
No Financial Credentials
BY DESIGN
ArbEdge is a market data platform only. We never request, store, or have access to any exchange API keys, trading account passwords, or brokerage credentials of any kind.
No Advertising Trackers
BY DESIGN
We use no advertising networks or tracking pixels. Visits are counted with privacy-friendly, cookieless analytics (Plausible and Cloudflare Web Analytics) and our own page counter.
Minimal Data Collection
BY DESIGN
We store your email only if you create an account or confirm alert emails, plus your alert settings. Discord and webhook addresses and Telegram bot tokens are encrypted. Your watchlist stays in your browser.
What We Store vs What We Don't
✓ WE STORE
·Email address (account or confirmed email list)
·Alert settings: threshold, coins and channels (delivery addresses and bot tokens encrypted)
·Page views (page and referring site, no IP address)
·Hosting logs, for a limited period
·Watchlist (in your browser only)
✗ WE NEVER STORE
·Exchange API keys
·Trading account credentials
·Your passwords (Google sign-in passwords never reach us; any password you set is held by Clerk)
·Payment or financial data
·Withdrawal or transfer access
·Device fingerprints
·Advertising identifiers
WHAT WE DON'T DO
✗ WE DON'T EXECUTE TRADES
ArbEdge is read-only. We display market data. We cannot place, modify, or cancel orders on any exchange.
✗ WE DON'T HAVE FUND ACCESS
We have no connection to any exchange account. Your funds cannot be accessed, moved, or affected by ArbEdge in any way.
✗ WE DON'T SELL YOUR DATA
Your email and preferences are never sold, rented, or shared with third parties for commercial purposes.
✗ WE DON'T USE YOUR DATA FOR ADS
No advertising networks have access to your data. ArbEdge products are ad-free.
BREACH NOTIFICATION COMMITMENT
In the event of a confirmed security breach affecting stored user data, we will notify affected users by email within 72 hours of confirming the breach. We will describe what was affected and provide guidance on protective actions.
Report a Security Vulnerability
If you discover a security vulnerability in ArbEdge, please report it responsibly to [email protected] with the subject line "Security Vulnerability." We take all reports seriously and will respond within 48 hours. Please do not publicly disclose vulnerabilities before we have had the opportunity to address them. See also /.well-known/security.txt.
HomeDashboardPast SignalsChartsAboutContactStatusSecurityPrivacyTermsRiskDisclaimerCookiesChangelog