Server-owned secrets
Provider keys, service-role keys, JWTs, webhooks, and private prompts stay out of browser bundles.
Security
Sensitive portfolio data deserves server-first boundaries.
The architecture keeps finance calculations, provider access, ownership checks, and audit-backed mutations behind server boundaries.
Ownership enforcement
Go validates Clerk identity and enforces access on every user-owned finance resource.
AI tool boundary
Model tools call application-owned APIs, never unrestricted database credentials.
Privacy scrubbing
Analytics and errors must redact PII, holdings, prompts, outputs, and financial amounts.