How Ziggma Keeps Your Portfolio Data Secure

Image representing security of account linking


Linking investment accounts requires trust. This page explains exactly how Ziggma protects your data — what we access, what we never touch, how it's stored, and what happens if you decide to leave. No vague assurances. Just the specifics.

Credentials never stored

OAuth means your login stays between you and your broker

Read-only access

Ziggma can view your holdings — never trade or move funds

Encrypted at rest & in transit

AWS-hosted, bank-grade encryption on all data

Data never sold

We earn from subscriptions — your data is not our product


How account linking works — and why your credentials are never at risk

When you connect a brokerage or retirement account to Ziggma, the connection is handled entirely by a third-party aggregator — either Snaptrade or Plaid. Ziggma never sees, receives, or stores your login credentials at any point in the process.

For virtually all major US brokers — including Fidelity, Charles Schwab, Robinhood, Vanguard, and Coinbase — the connection uses OAuth 2.0. With OAuth, you authenticate directly on your broker's own login page. The broker then issues a limited-scope access token to the aggregator. Your username and password never leave your broker's systems.

In the small number of cases where a broker does not yet support OAuth, your credentials are sent directly to that broker's systems via the aggregator — they never enter Ziggma's infrastructure.

What Ziggma receives: read-only data — account balances, holdings, and transaction history. Nothing more. Ziggma cannot initiate trades, move funds, or make any changes to your accounts. Learn more about how aggregators work in our financial account aggregators guide.


For a full comparison of Plaid, Snaptrade, Yodlee, Akoya, and Finicity, see financial account aggregators demystified .

How your data is encrypted

All portfolio data stored in Ziggma is protected by multiple layers of encryption, following the same standards used by major financial institutions.


Learn about portfolio aggregation and whether Plaid is sage.  

Third-party security certifications

Ziggma's account aggregation partners — Snaptrade and Plaid — hold independent security certifications that are verified by external auditors, not self-reported. These are the same standards required by banks and enterprise financial institutions.

Investment aggregation

Snaptrade

  • SOC 2 Type II — independently audited controls verified over time, not just at a point in time
  • Penetration testing — continuous third-party security audits by external security firms
  • Bug bounty program — active responsible disclosure program; verified findings reviewed and rewarded
  • AWS KMS encryption — credentials encrypted at rest using AWS Key Management Service
  • 24/7 monitoring — all systems and data access continuously monitored

Broad account aggregation

Plaid

  • SOC 2 Type II — independently audited security controls
  • ISO 27001 — internationally recognised information security management certification
  • ISO 27701 — privacy information management extension to ISO 27001
  • GDPR & CCPA compliant — meets EU and California consumer privacy requirements
  • TLS + AES-256 — encryption in transit and at rest to financial institution standards

SOC 2 Type II is the most rigorous of the SOC certifications — it evaluates whether security controls operate effectively over an extended period (typically 6–12 months), not just whether they exist on paper. ISO 27001 is the internationally recognised standard for information security management, required by enterprise financial institutions globally.

What would happen if Ziggma's servers were breached

This is the question most investors don't ask but should. Here's the honest answer, layer by layer:

In the unlikely event of a breach, your money is not at risk. Ziggma has no ability to access or move funds — it is a read-only analytics layer on top of your accounts.


Ziggma's data policy in plain terms


Your data from connection to deletion

01

You connect a broker

You authenticate on your broker's own login page via OAuth. Your credentials stay there.

02

Token issued

Your broker issues a read-only access token to Snaptrade or Plaid. No password involved.

03

Data retrieved

Holdings, balances, and transactions are fetched and passed to Ziggma — encrypted in transit.

04

Stored encrypted

Your data sits on AWS servers encrypted at rest. Decryption keys are held separately.

05

You stay in control

Revoke access anytime from Ziggma or directly from your broker's connected apps settings.

06

Full deletion on request

Delete your account and all data is permanently removed. Broker connections terminated automatically.

Frequently Asked Questions

No — and this is a firm commitment, not a policy subject to change. Ziggma's business model is a straightforward SaaS subscription. Revenue comes from monthly and annual plan fees, not from selling or monetising user data. Your portfolio data has never been sold and never will be.

No. Account linking is handled entirely by Snaptrade or Plaid — Ziggma never receives, processes, or stores your login credentials at any step. For the large majority of brokers, OAuth means your credentials don't leave your broker's own systems at all.

For a full explanation of how this works, see our financial account aggregators guide.

Very secure. Ziggma uses Snaptrade and Plaid — the leading investment account aggregators in the US — both of which use OAuth-based connections with all major brokers. OAuth eliminates credential sharing entirely. The connection is read-only, encrypted in transit, and can be revoked at any time.

For more on the security standards behind these connections, see how secure is linking your account.

All data is encrypted at rest and in transit. Ziggma's servers are hosted on Amazon Web Services (AWS) in the United States, using bank-grade AES-256 encryption for stored data. All connections between your browser and Ziggma's servers run over HTTPS. Database backups are encrypted on the same standard as live data — no unencrypted copies exist at any point.

No. Ziggma has read-only access to your account data. It can retrieve balances, holdings, and transaction history — but it has no ability to initiate trades, transfer funds, or make any changes to your brokerage or retirement accounts whatsoever.

Ziggma accesses only what is needed to provide portfolio analytics: account balances, holdings (positions and quantities), and transaction history. It does not access full account numbers, Social Security numbers, payment card data, or any information beyond what is required to power the portfolio analysis features.

Your money would not be at risk. Ziggma holds no credentials and has no ability to access or move funds. In the event of a breach, an attacker would find encrypted portfolio data — unreadable without the separate decryption key — and no passwords or full account numbers to exploit. Any OAuth access tokens are read-only and can be revoked instantly from your broker's connected apps settings.

All data is stored on Amazon Web Services (AWS) servers located in the United States. AWS operates under strict compliance frameworks and provides the same infrastructure used by banks and major financial institutions globally.

You can disconnect any linked account from within Ziggma at any time from the Investment Accounts section. You can also revoke access directly from your broker's connected apps or third-party access settings — this immediately invalidates the OAuth token. Both routes fully terminate the connection. See the Ziggma FAQ for step-by-step guidance.

All your data is permanently deleted from Ziggma's database. This includes all portfolio data, transaction history, and account information. Broker connections are terminated and Snaptrade and Plaid are notified automatically — no residual data is retained anywhere in the system.

If you'd like to explore Ziggma before committing, you can start free with no credit card required, or review the full plan comparison.