Security

Overview

OneArbitrage, LLC delivers OneArbitrage as subscription software: a public marketing website and native iOS and Android mobile apps where you manage your account, subscription billing through Stripe and Apple In-App Purchase on iOS, supported U.S. retail brokerage connections, and reverse stock split arbitrage (RSA) on accounts you link and enable. We design security and privacy into those surfaces. This page summarizes our approach at a high level. For what we collect and how we use it, see our Privacy Policy; for cookies and similar technologies, see our Cookie Policy; for the agreement that governs use of the Services, see our Terms of Service.

Native mobile apps (iOS and Android)

Our OneArbitrage apps use our customer application API and identity provider. Sign-in tokens are stored in the device's secure storage (platform keychain or encrypted keystore), not in ordinary app logs or shared clipboard. OneArbitrage account sign-in uses Amazon Cognito Hosted UI in your device's system or in-app browser. Stripe checkout and the Stripe billing portal also open in that browser so card details stay on Stripe's pages. iOS membership purchased in the app uses Apple In-App Purchase (StoreKit); card details stay with Apple. We receive subscription status and transaction identifiers, not your Apple ID password.

To refresh a Robinhood connection, the app may show Robinhood's login pages in an in-app browser (an embedded WebView). After you sign in, the app reads session tokens Robinhood stores there (including a refresh token) and sends them to our servers over HTTPS. We do not store your brokerage password. Some reconnect flows instead open a hosted page on our site in the system or in-app browser. API traffic from the apps uses HTTPS to our production endpoints. We do not ask you to email brokerage passwords or payment card numbers to support; use in-app flows instead.

Mobile measurement and tracking controls

Production app builds may include the Meta App Events SDK to measure onboarding and subscription actions for product and advertising analytics, paired with server-side Conversions API events that use shared event identifiers for deduplication (see our Privacy Policy). On iOS, we may show Apple's App Tracking Transparency prompt before enabling certain advertising measurement; you can deny tracking and continue using the app. On Android, you can limit ad personalization and reset your advertising ID in system settings. Development builds without configured measurement credentials skip client SDK events; server beacons may still record funnel steps needed to operate the product.

Authentication and sessions

Sign-in and sign-up use Amazon Cognito Hosted UI with industry-standard OAuth and PKCE. That lets you use security features your identity provider supports, such as multi-factor authentication and, where available, enterprise SSO and device policies.

After you authenticate in the mobile apps, sign-in state is held in secure device storage after Cognito completes in the system or in-app browser. Short-lived values used only to complete sign-in (and optional referral capture from a marketing-site URL or app invite link) may be held in browser session storage or secure app storage until the flow completes or your customer account is first provisioned, as described in our Privacy and Cookie policies.

Billing (Stripe and Apple)

On Android (and optional US iOS checkout through Stripe), subscription checkout and recurring billing run through Stripe at the weekly rate shown at checkout after your first successful trade. Card and bank details you enter for payment are handled by Stripe under its compliance programs; we use the identifiers and subscription status Stripe shares with us to show billing in the app, as described in our Privacy Policy. Manage Stripe payment methods and invoices in the app or Stripe-hosted flows we link you to, not by emailing card numbers to us.

On iOS, the primary paid path is Apple In-App Purchase. Apple processes the charge under Apple's terms. We receive signed transaction data and App Store Server Notifications so we can unlock the product and show status. We do not receive the card number on file with Apple. Cancel or change an App Store subscription in your Apple ID settings; deleting your OneArbitrage account does not stop those charges.

Brokerage linking and RSA

When you connect a supported U.S. retail brokerage, you authenticate with your broker the way they intend. We do not store your brokerage login password on OneArbitrage. After you sign in, we may receive session tokens your broker issues (including a refresh token) so RSA can keep running on accounts you enable. In the mobile app that often happens in an in-app WebView: the app reads tokens the broker stores in that browser and sends them to our servers over HTTPS. In some mobile fallbacks, reconnect uses a hosted page on our site. If a connection expires, the product will prompt you to reconnect. RSA runs automated workflow steps on accounts you link and enable; we scope access to what is needed to deliver that product behavior under your broker's rules and our agreements.

Unused accounts

If an account never subscribes and is not used, we may email two notices that state a deletion date, then delete the OneArbitrage login and the personal data we hold for that account. Signing in before that date keeps the account. We leave the account in place when it has ever subscribed, when it still has an open position, when the free first trade is already complete, or when a referral payout is still unfinished. We delete the brokerage session copy we stored. The brokerage account at Robinhood stays open. The binding description is in our Privacy Policy and Terms.

Transport and infrastructure

We use HTTPS for our public marketing site and mobile app API traffic in production so data is encrypted in transit. Our services run on major cloud providers (for example, AWS) and identity infrastructure as described in our Privacy Policy; we use access controls appropriate to production systems that process customer data. Brokerage session tokens and other sensitive credentials are stored with access limited to production systems that need them to operate the product, not in customer-facing logs or support channels.

Development practices

We treat dependency updates, patching, and code review as part of shipping and maintaining the product. This is an ongoing practice, not a guarantee that any single version is free of defects; software always carries residual risk.

Reporting security issues

If you believe you have found a security vulnerability in OneArbitrage, please email security@onearbitrage.com. Include enough detail for us to reproduce or understand the issue. We ask that you give us a reasonable time to investigate and remediate before public disclosure. Please do not test against customer accounts without authorization.

For general security questions that are not vulnerability reports (for example how sign-in or brokerage linking works in the product), use our Contact page, including support@onearbitrage.com.

This page is an overview for customers and researchers; it is not an exhaustive security program description or legal commitment.