Policies & security

Passwords are stored only as salted bcrypt hashes, never in plain text, and the signup form enforces a minimum password policy. Sessions ride an httpOnly cookie that page scripts cannot read. Optional two-factor authentication is available on every account, with backup codes, and sensitive account actions require a fresh second factor. Verification and reset links are single use and expire.

All connections use TLS; there is no unencrypted access. The application ships a strict Content-Security-Policy that limits where scripts can load from. Payments are processed by Stripe; your card number is entered on Stripe's systems and never touches ALAN's servers. We use a cookieless analytics service and run no advertising trackers.

Financial and disclosure data on the platform is parsed from public and government sources such as SEC EDGAR and official congressional filings. We do not sell your personal information. The Privacy Policy describes retention and your rights in full.

If you believe you have found a vulnerability, contact support@alanglobalintelligence.com with enough detail to reproduce it. Please give us a reasonable window to fix the issue before any public disclosure. We do not take legal action against good-faith research that respects user data and service availability.