Security & Data Transparency

• Your trading data stays in a local database on your machine. We never receive trades, fills, P&L, or balances.
• Broker credentials (when you use AutoSync) are stored in your OS keychain on that machine — not sent to IAG servers.
• The cloud account holds email, subscription/entitlement status, and device-link metadata so Leather Edition can sign you in and stay paid.
• Payments go through Stripe. We never see or store your full card number.
• TastyTrade AutoSync talks Mac → tastytrade directly (read-only OAuth). Brokerage data is not proxied through IAG.
• No third-party advertising or analytics trackers on the website.

Published service stack (see Privacy for detail): Supabase (auth & account DB), Stripe (payments), Vercel (site & API), Resend (transactional email), GitHub (installer hosting).

Below is a step-by-step protocol for verifying code identity, the local-first architecture, and the safety of TastyTrade AutoSync. No trust required — every claim gets tested.

Origin.Executed in full against the shipping build in July 2026 by a subscriber (iOS engineer / options trader) prior to connecting a live brokerage account. All checks passed. Reference results are included so you know what “pass” looks like.

Time. ~90 minutes, mostly passive monitoring. Tools. Terminal (built-in), LuLu (free, open-source firewall from Objective-See), and a web browser.

What has changed since that run.The protocol and every claim under test still stand, but two observations read differently on current builds. Sign-in no longer hands off to your web browser — as of 1.11.3 you type a short code into the app, so step 7 produces no browser callback at all (the app still never handles your password). And the Leather features added since — Market Awareness, Smart Watchlist, and IAG Read — periodically fetch a shared, non-personal dataset from the same account backend already listed below, so they add traffic to that one destination rather than a new one. Those fetches are requests for the shared brief or watchlist snapshot; your trades, positions, and P&L are not part of them. Two small things do travel outbound from these features, and both are worth naming: a thumbs up / thumbs down you click on a brief or an IAG Read, and — when you add or hide a ticker of your own on the Watchlist — that ticker symbol alone, as popularity telemetry used to decide which names join the shared list. The ticker telemetry is on by default and can be turned off in the Watchlist settings; it carries no position, size, or P&L. Step 9, the CSV-import litmus test, is unaffected and remains the check that matters.

Prefer the original artifact? Download the checklist (PDF).

Phase A — Verify the binary (before granting anything)

Claim under test: the app you downloaded is the app the developer built, signed by a verified identity, and scanned by Apple.

1. Install the app by dragging it to /Applications and eject the DMG. Always run from Applications — running from the mounted disk image triggers macOS app translocation and breaks updates.
2. Verify the code signature:codesign -dv --verbose=4 "/Applications/InvestingAgainsttheGrainJournal.app"

   Pass: Authority=Developer ID Application: Daniel Lemmon (C86X522W2S) (Apple identity-verified developer certificate) and flags=0x10000 (runtime) (hardened runtime enabled).

3. Verify Apple notarization:spctl -a -vv "/Applications/InvestingAgainsttheGrainJournal.app"

   Pass: accepted + source=Notarized Developer ID— Apple's notarization service scanned this exact build for malware.

Fail conditions (stop and contact support): unsigned or ad-hoc signature, a different signer identity, or rejected from spctl. Re-run the notarization check after every fresh download — it takes five seconds and re-verifies the supply chain.

Phase B — Watch the network (the local-first claim)

Claim under test:“Your trades never leave your machine.”

4. Quit IAG Journal completely. Install LuLu and approve its network extension (System Settings → General → Login Items & Extensions → Network Extensions → enable LuLu → allow the filter prompt).
5. Configure LuLu (menu bar icon → Settings):
   • Mode: Passive Mode OFF (you want alerts)
   • Rules: uncheck“Allow Already Installed Programs” — critical; if left on, LuLu silently whitelists the app and the test observes nothing
   • Rules: “Allow Apple Programs” ON; DNS + localhost allowed
   • View Rules → delete any pre-existing rules for the app
6. Launch IAG Journal and record every alert bearing its name. For each alert, expand Details & Options and use the process-ancestry icon to confirm the connection truly originates from the app.
   Reference result:exactly one destination at launch — the app's account/entitlement backend, port 443.
7. Log in when prompted.
   Reference result: login is browser-based with a localhost callback — the app never handles your password. No new destinations beyond the backend.
8. Let the app idle 15+ minutes.
   Reference result: silence. (Observed: 2+ hours, zero new connections.)
9. The litmus test — CSV import. Import a transaction CSV while watching LuLu.
   Pass: zero new outbound connections at the moment trade data enters the app. Trade data renders from the local database with no network involvement — observable proof of the local-first claim.
10. Identify every destination you allowed. LuLu often shows a bare IP (many cloud hosts publish no reverse DNS — normal). Look up ownership at ARIN: search.arin.net/rdap.

Any destination that doesn't map to the published stack (Vercel / Supabase / Stripe / GitHub per the Privacy Policy) or to tastytrade deserves a question before allowing.

Tip: when creating allow rules, choose Endpoint scope rather than Process scope. Process-scope rules whitelist all future destinations for the app, which blinds later observations.

Phase C — Data at rest

11. Confirm the database is local:ls ~/Library/Application\ Support/ | grep -i iag

    Reference result: iag-journal — your trades live in that folder, on your disk.

12. Confirm full-disk encryption:fdesetup status

    Pass: FileVault is On. If not, enable it before importing brokerage data — the local database is the asset the local-first model protects, and it flows into Time Machine backups too.

Phase D — TastyTrade AutoSync (the credential decision)

Claims under test: the app never sees your password, access is read-only, and brokerage data flows direct to tastytrade — not through IAG servers.

13. Follow the in-app AutoSync instructions to create a personal OAuth client at tastytrade. At the scope screen: check read only. Leave trade unchecked. This is enforced server-side by tastytrade — a read-only token is architecturally incapable of placing orders, no matter who holds it.
14. Store the client_secret and refresh_token in a password manager only (shown once; never in notes / files / screenshots).
15. Paste into IAG Journal and connect. Per the app's guidance, set the backfill start date appropriately if you've already imported history via CSV.
16. Post-connect verification (three checks):
    • Traffic: the sync fires a new LuLu alert. Identify the IP via ARIN. Pass: registrant is tastyworks, Inc. — your brokerage data goes Mac → tastytrade, direct. Fail (revoke immediately):sync traffic terminating at the app vendor's own infrastructure would mean brokerage data proxying through their servers.
    • Keychain:open Keychain Access, search “iag”. Reference result: iag-journal-tt entries in the login keychain (local, FileVault-protected, not iCloud-synced).
    • Kill switch:tastytrade → Manage → My Profile → API → Manage OAuth Grants — confirm your grant is listed. That page revokes the app's access instantly and unilaterally. Know where it is.

Ongoing posture

• Leave LuLu resident. Any new destination from the app after an update gets identified (ancestry → ARIN) before allowing.
• After each app update: re-run the spctl check (step 3) and glance at LuLu.
• The read scope is permanent. Treat any future request to expand permissions as a fresh security review.
• Keep your own system of record. A journal is an analytics layer; your data discipline shouldn't depend on any one tool.

Signed and notarized binary · two total network destinations across launch, login, hours of idle, CSV import, and live sync · zero traffic correlated with trade data entering the app · sync direct-to-broker (ARIN-confirmed) · passwordless OAuth with server-enforced read-only scope · credentials in the local keychain · unilateral revocation available at tastytrade.

Every published claim was observed, not just believed. The reviewer approved connecting to a live account.

Questions about security, data handling, or something you observed while running this checklist? Email support@iagjournal.com.