Is Read-Only Brokerage Linking Safe? What PickVesting Can and Cannot See

Is it safe to connect your brokerage to a third-party app with read-only access? A read-only connection is limited on purpose: it can read your trade history and holdings and nothing else, and it has no path to place trades or move money. On PickVesting, that link is what turns your actual account activity into a verified record instead of a screenshot. Below is exactly what the connection can see, what it cannot do, and how to check it before you link.

Read-only vs trading permissions: PickVesting uses read-only only

The short answer: PickVesting uses a read-only connection, full stop. A read-only link is different in kind from the permissions a broker uses for order entry or transfers. It grants the ability to read, not the ability to act.

The connection is made through SnapTrade, an aggregator that specializes in brokerage data. When you link an account, the scope is read history and holdings. There is no trade permission and no money-movement permission in that scope. So even in a worst case, the connection cannot do the things that would actually cost you: it cannot buy, sell, or withdraw.

This matters because your record on PickVesting is computed from the connection, not typed in. The record covers the whole linked account, every position across stocks, options and crypto, including contracts that expired worthless. Read-only is enough to build that. Anything more would be more risk for no benefit.

Where your password goes: the broker's own sign-in screen

Your brokerage password goes to your broker and nowhere else. When you link, you are handed off to your broker's own sign-in screen. You type your credentials there, on the broker's page, the same way you would logging into your account directly.

PickVesting never sees or stores a brokerage password. That is the whole point of the handoff. The app receives a connection token that authorizes reading your history and holdings; it never receives the credentials themselves. If a service ever asks you to type your brokerage username and password directly into its own form, that is a different and worse model. This is not that.

What the link can read: history and holdings for the linked accounts

The connection can read the trade history and current holdings of the accounts you link, and that is the extent of it.

From that data, PickVesting computes your record nightly. Metrics come from closed positions: time-weighted return, win rate, and max drawdown, shown over 7 days, 30 days, 90 days and all time. A figure never appears alone. Every return is shown next to how long the record has been verified and how many closed positions it covers, which is the difference between a number and a claim you can check. If you want to see what that looks like in practice, you can see how verified records look on Discover.

Snapshots are append-only. If something needs correcting, that correction is a new row. Nothing already recorded gets rewritten. The read-only link feeds a ledger that only grows.

What it cannot do: place trades, move money, change settings

This is the part sceptical traders should sit with, because it is the part that actually protects you. The connection cannot:

• Place a trade, buy or sell, in your account
• Move, transfer, or withdraw money
• Change any account setting or preference

There is no trade path and no money-movement path in a read-only link. Those permissions are not requested, not granted, and not available to the connection. The link reads; it does not act. Whatever happens to your record on PickVesting, the balance and the orders in your brokerage account remain entirely under your control, at your broker.

Encryption and revoke: sealed at rest, disconnect anytime

The connection secret is sealed with AES-256-GCM before it is stored. That is authenticated encryption applied to the token that authorizes the read, so the stored secret is not sitting in plain text.

And you are never locked in. You can revoke the connection at any time, either from inside PickVesting or from your broker's own connected-apps settings. Two independent off switches, one on each side. If you revoke from the broker, the link stops working regardless of anything on PickVesting's end. That is the control you want: the ability to end access yourself, immediately, without asking anyone.

What happens if you disconnect: history kept, gap visible, not a silent wipe

Disconnecting does not erase your record. When you revoke the link, PickVesting keeps everything up to that day and shows a visible gap for the period after it. Your history is not wiped and it is not silently deleted.

This cuts both ways, and it is deliberate. You keep the track record you earned. But you also cannot make an inconvenient stretch disappear by unplugging, because the gap is on the record for anyone to see. Every profile also states how many brokerage accounts are linked, so an unlinked account shows up as a visible absence rather than a secret. Transparency about the connection is part of the proof.

A practical checklist before you link

Before you connect anything, run through this. It applies to PickVesting and to any read-only tool.

1. Confirm the scope is read-only. You want read history and holdings, nothing that says trade, order, or transfer.
2. Check where you type your password. It should be your broker's own sign-in screen. If a form on the app itself asks for your brokerage login, stop.
3. Find the off switch, twice. Confirm you can revoke inside the app and from your broker's connected-apps settings before you commit.
4. Know what is stored. On PickVesting, the connection secret is sealed with AES-256-GCM, and the password is never received in the first place.
5. Understand the whole account is read. Your record covers every position in the linked account, so link the account you are comfortable showing in full.
6. Decide which accounts to link. Only the accounts you link are read. An account you do not link is not touched, and it shows as unlinked on your profile.

Supported brokers include Robinhood, Charles Schwab, Fidelity, E*TRADE, Interactive Brokers, Webull, tastytrade, Public, Vanguard, TradeStation, Alpaca, Wealthsimple and Questrade, and more, read-only via SnapTrade. If your broker is on that list, the link is the same read-only handoff described above.

What this still does not prove

A verified record is evidence about what happened, not a promise about what comes next. Read-only linking makes your history checkable. It does not make you safe to copy, and it does not do the following:

• It proves what happened in the linked accounts only. It says nothing about accounts you did not link.
• It does not know a reader's suitability, position size, or taxes.
• It does not predict your next trade or future results.
• It does not vouch for the quality of advice in any chat room.
• PickVesting does not place trades for anyone and does not offer copy trading. A follower's fill price differs from yours.

Security of the connection is one question. Whether a record proves what a claim implies is another, and we cover that in Verified Trading Record vs Screenshot: What Counts as Proof.

The bottom line for creators

A read-only link is the least-privilege way to prove a track record. You give up nothing that lets anyone act in your account, and you gain a record your audience can actually verify. Verification is free, permanently, so you can link a brokerage and publish a verified record without paying anything and link it from your existing X, YouTube, Discord or Whop presence.

Link read-only, get a verified URL. Verification is free.

PickVesting is not an investment adviser and does not provide personalized investment advice. Past performance is not a prediction of future results.