What is stored
Your account information is held in one database. These are the records it keeps.
| Record | Contents |
|---|---|
| Customer | Email address, display name, role, a hashed password, and the date the record was created. |
| Session | A hash of the session token, the customer it belongs to, an expiry timestamp and a creation timestamp. The token itself is not stored. |
| Account, transaction, position | Your accounts, the transactions recorded against them, and the investment positions held. |
| Support conversation | Conversation status, the customer it belongs to, any assigned staff member, and timestamps. |
| Support message | Message text, the sender, the sender type, and the time sent. |
Credentials and sessions
Passwords are hashed with scrypt using a salt unique to each customer, and checked with a constant-time comparison, so a wrong password cannot be told from a correct one by how long the answer takes. The password itself is never written to the database and cannot be recovered from it.
On sign-in the server generates a random session token, stores only a SHA-256 hash of it, and sets the token in a cookie with these properties:
| Cookie property | Value |
|---|---|
| HttpOnly | Enabled, so page scripts cannot read the session token. |
| SameSite | Lax, which limits the cookie being sent on cross-site requests. |
| Secure | Enabled in production, so the cookie is only sent over HTTPS. |
| Expiry | Set explicitly, and the session record carries a matching expiry that the server checks on every request. |
Because only a hash is stored, nobody can read your password back — including staff and anyone with access to the database. Any message asking for it is fraudulent. See security.
Customer-care messages
Messages are stored, so a conversation survives closing the page. Every request for a conversation checks that the signed-in customer owns it before anything is returned, and the same check applies to the live message connection.
Staff with access to the support inbox can read customer conversations, which is what allows them to answer. For that reason, a password, a one-time code or a full account number should never appear in a message.
What is not collected
- No analytics or tracking. This site carries no analytics service, advertising pixel or third-party tracking script.
- No third-party cookies. The only cookie set is the session cookie described above.
- No external assets. Fonts, icons and photographs are served from ARUPS, so loading a page makes no request to another company's servers.
- No marketing profile. Nothing held about your account is used for targeting, segmentation or promotion.
- No sale or sharing of account data. Account information is not passed to advertisers, data brokers or any other company for their own use.
