LunaTerminal Open LunaTerminal

Security and data handling

What LunaTerminal does with your data, how it is protected, and what is not in place yet, so you can decide what belongs in it.

Updated

Accounts

  • Passwords are stored only as salted, slow hashes.
  • Two-factor sign-in with an authenticator app and one-time recovery codes.
  • Sign-in with Google is optional.
  • Sessions use secure, HTTP-only cookies.
  • Deleting your account removes its saved items, connector credentials and scheduled agents.

Your data

  • As a guest, chats and settings stay in your browser.
  • Signed in, your chats, clients, portfolios, watchlists and settings are encrypted at rest with AES-256-GCM, each item bound to your account.
  • Revision checks stop one device from silently overwriting newer work from another.
  • Memory is explicit: the AI remembers only notes you add, and turning memory off excludes them from prompts.
  • All traffic uses HTTPS. The site runs on Cloudflare's network.

AI providers

Chat prompts, with the market data and attachments you include, are sent to Anthropic to be answered by Claude. Under Anthropic's commercial terms, API inputs and outputs are not used to train models by default. The portfolio builder sends your objective, constraints and notes to the AI provider only if you turn AI on.

Read-only by design

  • No feature places trades, moves money or holds assets.
  • Connected apps use read-only access: Gmail, Google Calendar and Google Drive read scopes, Outlook mail read, Notion and Linear.
  • Custodian data through Plaid Investments is read-only holdings and transactions.
  • Connector credentials are encrypted and never returned to the browser.

AI guardrails

  • Market data, attachments and search results are passed to the model as data, never as instructions.
  • Recognized requests for code, credentials or other off-topic tasks are redirected to financial questions before any model call.

Not in place yet

  • No SOC 2 report.
  • No email verification or password reset. If you signed up with Google, sign in with Google.
  • No single sign-on (SAML) or firm-wide admin controls on lunaterminal.com.
  • Not a books-and-records archive: export chats and reports and keep them under your firm's recordkeeping policy.

Report a security issue

Email patrick@feargreedflow.com. Please include steps to reproduce, and give us a chance to fix the issue before disclosing it.