Security & Privacy
Public notes on what Tickory protects, what the product does not access, and how to verify the service before you use it.
Security Commitment
Encryption in Transit
Tickory serves the product over HTTPS/TLS so account traffic, form submits, and alert routing setup are encrypted in transit.
Server-Side Storage
Passwords are stored as hashes. Scan definitions, alert settings, and delivery history stay server-side so Tickory can run scans for you and show what happened after an alert fires.
Authentication
Account access uses backend-issued JWT access tokens plus refresh tokens. The product also exposes dedicated security and support contacts when you need human verification.
Product Boundaries
Tickory is a monitoring and alerting product. It does not place trades, hold custody, or ask you to connect exchange accounts. That keeps the risk boundary narrower and easier to inspect.
Application Security
- • Rate limiting on all endpoints
- • Input validation and sanitization
- • Tenant-aware access checks in the application
- • Server-side alert delivery logs and proof trails
- • Security headers and hardened request handling
Public Verification
- • Public FAQ that explains who operates Tickory and what the product does
- • Public privacy policy and terms linked from the landing experience
- • Security contact at [email protected]
- • Support contact at [email protected]
What You Can Verify Today
- Read the About page for product scope and operating boundaries
- Review the FAQ for legitimacy and verification questions
- Open the Privacy Policy and Terms of Service before using live alerts
- Create a test scan or alert source and inspect the proof trail end to end
What We Do Not Store Or Access
- ✅ We DO NOT store exchange API keys
- ✅ We DO NOT connect to your exchange accounts
- ✅ We DO NOT place trades on your behalf
- ✅ We DO NOT have access to your funds
What We Do Store
- Account email (password stored as a hash)
- Scan configurations and alert settings
- Scan execution history
- Alert delivery history
- Usage metrics
Security Best Practices for Users
- Use a strong, unique password - Tickory requires letters and numbers, and longer passwords are safer
- Do not share credentials - Each user should have their own account
- Review alert settings regularly - Make sure destinations and webhook endpoints still match your intent
- Use webhook secrets - Validate webhook signatures in your integrations
Incident Response
In the event of a security incident, we will:
- Immediately investigate and contain the issue
- Assess affected users, systems, and delivery channels
- Notify affected users when required and once the facts are verified
- Implement preventive follow-up work
Reporting Security Issues
Security Contact
If you discover a security vulnerability, please report it to:
Email: [email protected]
Please do not publicly disclose security issues until we have had a chance to address them.
Questions about security?
Contact our security team at [email protected]