Security · Tiedbook

Tiedbook · Operated by MRSLM Group LLC Last updated: October 20, 2026

This page gives an honest overview of how we protect your data. It is informational and does not create contractual commitments beyond our Terms of Service and Privacy Policy.

1. Our approach

Tiedbook is designed so that we hold as little sensitive information as possible. We work from the exports your platforms already produce. We do not need broker logins, we never touch your money, and we have no ability to trade. The most sensitive items we hold are your trade history and, if you choose to connect sync, a read-only API key.

2. Design choices that limit risk

No broker passwords. We never ask for or store the password to your broker, platform or prop-firm account.
No trading capability. Tiedbook has no function to place, modify or cancel orders. For the optional TopstepX/ProjectX sync, our client is built to call only read-only endpoints and to reject order-related endpoints before any request is sent.
In-browser Statement Check. The free tool at /check parses your file in your browser. The file is not uploaded to our servers.
No card data. Payments are handled by Stripe. Card numbers go directly to Stripe and never touch our servers. Stripe is certified to PCI DSS Level 1 (that is Stripe's certification, not ours).
Import preview. Nothing from an import is saved until you confirm it.

3. Infrastructure

Hosting. The Tiedbook application and its PostgreSQL database run on a virtual private server provided by Hostinger in its Boston, USA data center. Our domain and DNS are also managed with Hostinger.
Network. The server exposes only the ports needed to serve the website and application. The database is not directly reachable from the public internet. It sits on a private network that only the application joins.
Updates. Operating-system and dependency updates are applied as part of running the server. This page does not promise a fixed patch calendar.

4. Encryption

In transit. All traffic to tiedbook.com is served over HTTPS (TLS), and our site sends an HTTP Strict Transport Security (HSTS) header so that browsers always connect securely.
API keys at rest. If you ask us to save a TopstepX API key, we encrypt it with AES-256-GCM before it is written. The secret that unlocks it is kept separate from the database. A sync you do not ask us to save is not written down. If we cannot encrypt a key, we do not save it, and we never store a key in readable form.
Passwords. Passwords are never stored in readable form. They are stored as salted scrypt hashes.

5. Access controls

Your data is separated. Every database query for journal data is scoped to the signed-in user, and the application connects to the database with a restricted role that cannot bypass row-level security.
Least privilege. Access to production systems is limited to the minimum number of authorized people needed to run the Service, and only for operating, supporting and securing it.
Support access. We do not look at your Customer Data unless you ask us to (for example, to troubleshoot an import), or where it is necessary for security or required by law.

6. Backups and resilience

Backups. The server that hosts Tiedbook takes its own nightly backup. That backup stays with the server. It is not a second geographic copy, and this page does not claim a restore drill or a certification.
Your own copies. You can export your journal at any time. We recommend keeping your original platform exports and statements too.
No uptime guarantee. We do not offer a service level agreement; see Section 17 of our Terms.

7. Application security

Imports are treated as untrusted input and parsed defensively.
Sessions use secure, HTTP-only cookies.
Standard protections against common web attacks (such as cross-site scripting, cross-site request forgery and SQL injection) are built into how the application is written.
Our site sends security headers including Strict-Transport-Security, X-Content-Type-Options: nosniff and a strict referrer policy.

8. Your part

Use a strong, unique password for Tiedbook.
Create API keys with the narrowest permissions your platform allows, and revoke any key you no longer use or believe has been exposed.
Keep your devices and browser up to date.
Be wary of emails asking for passwords or keys. We will never ask for your password, your broker password or your full API key by email.

9. Incidents

If we become aware of a security incident that affects your personal information, we will investigate promptly, take steps to contain it, and notify affected users and regulators as required by law (including Florida's data-breach notification law and, for people in the EEA/UK, the GDPR), without undue delay.

10. Responsible disclosure

We welcome reports from security researchers.

How to report. Email security@tiedbook.com with a description of the issue, the steps to reproduce it, and its potential impact. Please do not include other users' personal data.

Our commitments. We will acknowledge your report within 3 business days, keep you informed of our progress, and credit you (if you wish) once the issue is fixed. We will not pursue legal action against researchers who act in good faith and follow these guidelines.

Guidelines. Please:

test only against your own Account or a test Account you created;
do not access, modify or delete other users' data; if you encounter it, stop and tell us;
do not run denial-of-service, spam, social-engineering or physical attacks, or automated scanning that degrades the Service;
give us reasonable time to fix the issue before disclosing it publicly; and
comply with all applicable laws.

We do not currently run a paid bug-bounty program.

A machine-readable contact is published at /.well-known/security.txt.

11. Contact

Security: security@tiedbook.com · Privacy: legal@tiedbook.com · Support: support@tiedbook.com

Security at Tiedbook