How Deskcast keeps your account, your broker keys and your device safe

A desk display that shows your portfolio is a small thing on your desk and a big question in your head: who else can see this? It is the right question, so here is the full answer, in plain language. No marketing adjectives, just what we store, how it is protected, and what we never touch.

The short version: we collect as little as we can, we encrypt what we have to keep, and we design every part assuming something else might one day fail.

We keep very little

The safest data is data that does not exist. A Deskcast account is an email address and a password. Your panel’s settings are the symbols you chose and how often to refresh them. That is it unless you choose to connect a broker.

• No card numbers. Payments run on Stripe’s own page. Stripe tells us you paid; your card number never reaches us.
• No selling or sharing for advertising. Analytics only load if you accept them in the cookie banner.
• Delete means delete. Disconnecting a broker deletes its keys. Deleting your account deletes them too.

Your password is never stored

We store a salted bcrypt hash of your password, never the password itself. Two people with the same password get different hashes, and nobody, including us, can turn a hash back into a password.

Signing in gives your browser a session cookie that page scripts cannot read (HttpOnly), that only travels over HTTPS (Secure), and that other sites cannot use to act as you. Every change to your account is also checked against a CSRF token. The login form gives the same answer for an unknown email and a wrong password, so it cannot be used to find out who has an account. Signing out ends the session on the server, not just in your browser.

Broker keys: read-only, encrypted, never shown again

To show your portfolio, Deskcast can connect to Trading 212, eToro or Interactive Brokers using a key you create in your broker’s app. This is the most sensitive thing we hold, so it gets the strictest treatment:

1. Read-only by design. We ask you to create a key with read permissions only. Even if a key could do more, our code for each broker only knows how to read. There is no code path that places an order or moves money.
2. Encrypted at rest with AES-256-GCM. Each key is sealed with a fresh random nonce, and the seal is bound to your account, so an encrypted key copied onto another account’s row will not open. The encryption key lives only on the production server, never in the code or the database.
3. Never sent back out. After you paste it, the key never leaves our backend again: not to the website, not to the panel, not to a log line or an error message. Your account page shows only its last four characters, so you can tell which key is connected.
4. Amounts stay private by default. The panel shows percentages unless you turn amounts on. When they are off, the values are removed on our server, so they never reach the device at all.

Every device has its own identity

Each Deskcast gets a unique secret on our bench before it ships. Only a hash of that secret is sent to our server, so even a full copy of our database would not let anyone pretend to be your panel.

• Pairing needs you. A panel only joins your account when you approve its code while signed in. A panel owned by someone else cannot be taken over; its owner has to release it first.
• Short-lived tokens. The panel talks to us with tokens that expire and are replaced. A token that shows up again after it was replaced means someone copied it, and every token for that device is revoked.
• One click to cut off. Unpairing a panel on your account page revokes all of its tokens. It stops working on its very next request, not when a timer runs out.
• A token is not a key to everything. A panel can only ask for the symbols in its own settings. It cannot be used to read anyone else’s data.

Encrypted connections, checked properly

Everything between your browser, your panel and our server runs over TLS. The panel does not trust whatever certificate it is shown: it carries a fixed list of root certificates, each one pinned by its fingerprint, and refuses anything else.

A check runs on a schedule against the live certificates, so a change in who issues them is caught by us long before it could ever lock a panel out. Our server has no open inbound ports: traffic reaches it through an outbound-only tunnel behind Cloudflare, with security headers and rate limits on every API call.

Updates only install if they are ours

Deskcast updates itself over the air, which is exactly where a careless device becomes a dangerous one. Every firmware release is signed with an Ed25519 key that never leaves our release process. The panel checks that signature against the public key built into it before it will install anything. An image that is tampered with, corrupted in transit or simply not ours is rejected, and the panel keeps running the version it has.

Security is a habit, not a feature

None of this was bolted on at the end. Every backend change is checked against a written security checklist: secrets are never logged, never returned, never stored in plain text, and every endpoint that calls a third party is rate-limited. Logs mask tokens, cookies and passwords automatically. Automated tests run on every change, including tests that confirm a key cannot be decrypted on the wrong account and that a raw password never reaches the database.

No honest company can promise that nothing will ever go wrong, and you should be wary of any that does. What we can promise is that we take the question seriously, that we build so one failure does not become a disaster, and that we will tell you plainly if something ever happens.