Security at Gecko
Last updated: May 24, 2026
Your trade history is some of the most personal data you have, and Gecko is built to treat it that way, from the moment you upload a statement to the day you delete your account. This page is a plain-English overview of how your data is kept secure.
Encrypted in transit
Every connection to Gecko, including the website, the application, and the API, is served exclusively over HTTPS and encrypted with modern TLS. The connection between our application servers and the database is encrypted with TLS as well. Your data is never sent over an unencrypted channel.
Encrypted at rest
The database that holds your account, uploaded trades, journal entries, and diagnoses is encrypted at rest. The data sits on encrypted storage, so the underlying disks are unreadable on their own. Passwords are protected even further, as described in Account security below.
Where your data lives
Gecko’s database is hosted on Amazon Web Services (AWS) infrastructure in the US East (Northern Virginia) region, and our application servers run in the same region. Your data is stored and processed in the United States, and stays on US soil in the course of normal operation.
Backups and recovery
The database keeps a continuous seven-day history, so it can be restored to any point within the past week. That protects your data against accidental changes, a faulty update, or corruption. History retention runs automatically, with nothing for you to manage.
Account security
Passwords are never stored in a readable form. Each one is hashed with PBKDF2-HMAC-SHA256 using 600,000 iterations and a unique random salt before it is stored, which means even we cannot see your password. You can also sign in without a password at all, using an emailed magic link that expires after 24 hours and works only once. Your signed-in session is held in a signed, HTTP-only cookie that page scripts cannot read.
Payments
Subscription payments are handled entirely by Stripe, a PCI-DSS Level 1 certified payment processor. Your full card number never reaches Gecko’s servers; we receive only a customer reference and your subscription status. Card data stays with Stripe, on infrastructure built and audited for exactly that purpose.
Your data, your control
From Settings you can permanently delete your account at any time. That removes your account and all of its data for good, and cancels any active subscription at the same time. If you ever want Gecko to hold nothing about you, that path is one click away.
Reporting a vulnerability
If you believe you have found a security issue, please tell us through the (the Feedback button at the bottom-right of any page). We take every report seriously, will acknowledge it, and will work in good faith to confirm and resolve it. Please give us a reasonable chance to address an issue before disclosing it publicly.
Security questions are welcome any time through the . For how we collect and use data more broadly, see our Privacy Policy.