Security

Overview

OneArbitrage delivers OneArbitrage as subscription software: a public marketing website, a customer dashboard on the web and in native iOS and Android apps where you manage your account, subscription billing through Stripe, supported U.S. retail brokerage connections, and reverse stock split arbitrage (RSA) on accounts you link and enable. We design security and privacy into those surfaces. This page summarizes our approach at a high level. For what we collect and how we use it, see our Privacy Policy; for cookies and similar technologies, see our Cookie Policy; for the agreement that governs use of the Services, see our Terms of Service.

Native mobile apps (iOS and Android)

Our OneArbitrage apps use the same customer-dashboard API and identity provider as the web dashboard. Sign-in tokens are stored in the device's secure storage (platform keychain or encrypted keystore), not in ordinary app logs or shared clipboard. Sensitive flows that involve payment credentials or brokerage authorization open in the system browser (Stripe Checkout, Stripe Customer Portal, Cognito Hosted UI, and supported broker reconnect flows), so card and broker login details stay on those providers' pages under their security programs.

API traffic from the apps uses HTTPS to our production endpoints in line with the web dashboard. We do not ask you to email brokerage passwords or payment card numbers to support; use in-app or dashboard flows instead.

Mobile measurement and tracking controls

Production app builds may include the Meta App Events SDK to measure onboarding and subscription actions for product and advertising analytics, paired with server-side Conversions API events that use shared event identifiers for deduplication (see our Privacy Policy). On iOS, we may show Apple's App Tracking Transparency prompt before enabling certain advertising measurement; you can deny tracking and continue using the app. On Android, you can limit ad personalization and reset your advertising ID in system settings. Development builds without configured measurement credentials skip client SDK events; server beacons may still record funnel steps needed to operate the product.

Authentication and sessions

Sign-in and sign-up use Amazon Cognito Hosted UI with industry-standard OAuth and PKCE. That lets you use security features your identity provider supports, such as multi-factor authentication and, where available, enterprise SSO and device policies.

After you authenticate, our web customer dashboard may establish a secure session using an HttpOnly session cookie on the customer application's domain, as described in our Privacy and Cookie policies. Short-lived values used only to complete the sign-in flow (and optional referral capture from the marketing site URL) may be held in browser session storage on our marketing origin until the flow completes or your customer account is first provisioned. In the mobile apps, equivalent sign-in state is held in secure device storage after Cognito completes in the system browser.

Billing (Stripe)

Subscription checkout and recurring billing run through Stripe. Card and bank details you enter for payment are handled by Stripe under its compliance programs; we use the identifiers and subscription status Stripe shares with us to show billing in the customer dashboard, as described in our Privacy Policy. Manage payment methods and invoices in the dashboard or Stripe-hosted flows we link you to, not by emailing card numbers to us.

Brokerage linking and RSA

When you connect a supported U.S. retail brokerage, you authenticate with your broker the way they intend. We do not store your brokerage login password on OneArbitrage. If a connection expires or needs to be refreshed, the product will prompt you to reconnect so service can continue without holding secrets we should not keep. RSA runs automated workflow steps on accounts you link and enable; we scope access to what is needed to deliver that product behavior under your broker's rules and our agreements.

Transport and infrastructure

We use HTTPS for our public marketing site, web customer dashboard, and mobile app API traffic in production so data is encrypted in transit. Our services run on major cloud providers (for example, AWS) and identity infrastructure as described in our Privacy Policy; we use access controls appropriate to production systems that process customer data.

Development practices

We treat dependency updates, patching, and code review as part of shipping and maintaining the product. This is an ongoing practice, not a guarantee that any single version is free of defects; software always carries residual risk.

Reporting security issues

If you believe you have found a security vulnerability in OneArbitrage, please email security@onearbitrage.com. Include enough detail for us to reproduce or understand the issue. We ask that you give us a reasonable time to investigate and remediate before public disclosure. Please do not test against customer accounts without authorization.

For general security questions that are not vulnerability reports (for example how sign-in or brokerage linking works in the product), use our Contact page, including support@onearbitrage.com.

This page is an overview for customers and researchers; it is not an exhaustive security program description or legal commitment. Your counsel can help align public language with your policies and any regulatory obligations.