Security
How your account is protected
Logging in to Folio goes through Privy, which handles secure access to your assets. Folio never holds your assets and never receives your private access credentials — your login lives with your provider. On your device, Folio can require your fingerprint before confirming an action, so a trade only moves with your deliberate approval.
Because your holdings are self-custodied through your login provider rather than held by Folio, no single breach of Folio’s own systems can move your assets.
Reporting a vulnerability
If you believe you’ve found a security issue in tryfolio.io or the Folio app, tell us before telling anyone else. Email [FOUNDER: security contact email] with enough detail to reproduce it. We investigate every report in good faith and will not pursue legal action against researchers who report responsibly, avoid privacy violations and service disruption, and give us reasonable time to respond before any public disclosure.
Scope: tryfolio.io and the Folio app.
Response target: we aim to acknowledge reports within [FOUNDER: response time, e.g. “two business days”].
security.txt
The following is published at /.well-known/security.txt:
Contact: mailto:[FOUNDER: security contact email]
Expires: [FOUNDER: expiry date, ISO 8601, e.g. 2027-10-05T00:00:00.000Z]
Preferred-Languages: en
Canonical: https://tryfolio.io/.well-known/security.txt