Security
Is Vestmind safe? Security and your data
What Vestmind can see, what it can never do, and how to take your data back.
Answer
Vestmind is built so that it can read your portfolio but never act on it. Broker connections are read-only and no part of Vestmind can place an order; broker secrets stay on Vestmind's servers; broker access tokens are encrypted at rest; and portfolio data is never sold. You can disconnect a source, download your data or ask for it to be deleted at any time.
Protection
How your data is protected
Read-only by construction
Vestmind reads holdings, positions and balances. No broker adapter implements an order method, so there is no code path that could buy, sell or move anything.
You sign in with your broker, not with us
Zerodha and Angel One connections use the broker's own login page; Groww uses an access token that Groww issues to you. Vestmind never asks for, or stores, your broker password.
Secrets stay on the server
Broker API secrets and access tokens never reach your browser, and the page never calls a broker directly. The exchange happens between Vestmind's servers and the broker.
Encrypted at rest
Broker access tokens — the one thing that grants access rather than describing it — are encrypted with AES-256-GCM, so a tampered record fails to decrypt instead of yielding a usable key.
No holdings kept without an account
A statement uploaded without an account is parsed and analysed for that request, and neither the file nor its holdings are written to storage. Only the portfolio's total value and its split across asset classes are kept, anonymously, for Vestmind's aggregate figures.
Not sold, not shared
Portfolio data is used to produce your analysis and is never sold. It is shared only with the providers needed to deliver the service, such as your broker, or where the law requires.
Your control
Connect or disconnect any source, update your information, download your data or request deletion at any time.
What Vestmind is not
Vestmind is not a broker, a custodian or a SEBI-registered investment adviser. It never holds your money or securities, and nothing it shows is personalised investment advice.
What is collected and how it is used is set out in the privacy policy. Questions about your data: support@vestmind.in.
FAQ
Questions about security
Everything you need to know about how Vestmind handles your data.
Contact usIs Vestmind safe to use?
Vestmind is designed to read your portfolio and never act on it. Broker connections are read-only, secrets stay on the server, access tokens are encrypted at rest, and your data is never sold. You stay in control of every connection and can delete your data at any time.
Can Vestmind place trades or move my money?
No. No part of Vestmind can place, modify or cancel an order, and Vestmind never takes custody of your money or securities. Every trade happens in your own broker account, by you.
Does Vestmind see or store my broker password?
No. For Zerodha and Angel One you sign in on the broker's own page and Vestmind receives a token that grants read access. For Groww you provide an access token Groww issues. Your password is never shared with Vestmind.
Does Vestmind sell my data?
No. Portfolio data is used to build your view, generate insights and improve the products. It is not sold, and it is shared only with the providers needed to deliver the service or where the law requires.
How do I delete my data?
Disconnect any source from your account at any time, and write to support@vestmind.in to request deletion or a download of your data. The privacy policy sets out what is collected and how it is used.
Is Vestmind regulated by SEBI?
Vestmind is not a SEBI-registered investment adviser, research analyst or broker, and does not claim to be. It is an investment intelligence platform: it analyses and explains, and every investment decision remains yours.