01
Credentials stay at the broker
You authorize with the broker provider. Heuby does not ask for broker passwords in the app.
Security
Plain boundaries for a serious workspace.
Public outside. Workspace inside.
How your data is held
Practical security. Not a badge.
SnapTrade brokers the broker handoff when enabled. Heuby keeps the boundary plain: public site outside, authenticated workspace inside.
02
Read sync by default
The product is built around pulling records into the workspace, not placing trades from it.
03
Disconnect when needed
SnapTrade connections can be removed while existing imported records remain available for review.
04
Authenticated workspace
Dashboard, import, reports, settings, trade log, journal, and watchlist routes sit behind session auth.
05
Same-origin web API path
The web app calls `/api` through the Next.js proxy so browser requests stay aligned with the app origin.
06
Portable records
Profile data, trades, portfolios, targets, watchlist, journal entries, and connection metadata can be exported.
Production checks
Launch posture should stay explicit.
The repository already names the deployment switches that matter before real financial records enter a hosted environment.
Set a strong JWT secret before production use.
Use secure cookies behind HTTPS.
Configure production CORS origins intentionally.
Keep registration invite-only or closed for private previews.
Open Heuby when the boundary is clear.
Review the security posture, configure the deployment, then start with the records you are ready to bring together.