Security
What we ask for
A Trading 212 API key and secret, generated from your Trading 212 account. When you create the key, Trading 212 lets you choose permissions in four categories: account data, history, orders, and portfolio. Enable those four and leave anything related to placing trades or moving money switched off.
What we can and can't do
We read your orders, transaction history (deposits and withdrawals), dividends, and current holdings. We cannot place trades or move money: the code that talks to Trading 212 only ever makes read (GET) requests. There is no code path in BenchMarked that submits an order or a transfer, regardless of what the key itself is allowed to do.
How the key is stored
Both the key and secret are encrypted with AES-256-GCM before they touch the database. They're decrypted only in server memory, only to run a sync, and are never sent back to your browser once saved.
Your controls
Revoke the key in Trading 212 at any time. It stops working immediately, since we never cache it outside the encrypted database row. Deleting your BenchMarked account permanently deletes the stored key along with everything else tied to your account.
What we don't do
We don't sell your data or share it with anyone beyond the infrastructure that runs this app: Supabase (database and authentication) and Vercel (hosting).
Ready to connect? Set up your account