You scroll all the way to the bottom of the TradingView site, and right under the line “© 2026 TradingView, Inc.” two huge buttons in stern frames jump out at you: SOC 2 Compliant with a round seal and GDPR Compliant ringed by the EU’s little stars. It looks monumental — you’re instantly filled with respect for the platform’s hard-nosed security people. You click those badges out of pure curiosity, to see how exactly this impenetrable armor was forged, and you land on the page trust.tradingview.com.
And this is where, once you start digging, an absurdity opens up that leaves you not knowing whether to laugh or cry.
The shop window is decorated with SOC 2, PCI DSS 4.0.1, GDPR and DORA badges, and next to them a green indicator ticks away cheerfully: “Updated 4 minutes ago” — as if to say, four minutes ago we checked every lock, the border is bolted shut. Below that, twenty solid-sounding points of infrastructure protection are lined up: server access strictly by cryptographic keys, networks segmented, encryption on, the intrusion detection system never sleeps.
You start looking closer at the details — and the column with the actual status of the checks is simply empty. The reports themselves are hidden behind a “Request access” button, and nobody is going to let a random person off the street in there. But the funniest part isn’t even that: not one of those twenty formidable points on the page was written by TradingView engineers. This entire “fortress” was generated wholesale from a ready-made template by a third-party American outfit called Vanta.
To prove there are no burglars in the house, let strangers into every bedroom
How does this business work? In the corporate world, services are required to produce a piece of paper from an auditor — that very SOC 2 certificate. It used to mean putting up with live inspectors in your office for months, tediously poking through server settings. Then Vanta showed up and offered the industry a brilliant cheat code: “You don’t need to collect anything by hand. Hook our software up to your company, we’ll tick the auditor’s boxes for you in the background, and while we’re at it we’ll draw you a pretty shop window with badges on your website.”
Now watch closely. To hang a proud “We let nobody near your data” button in the website footer, a company voluntarily lets an outside firm under its own hood. It gives Vanta’s servers access to its cloud infrastructure (AWS, Google Cloud), to its source code on GitHub, to its corporate email and to the HR database with lists of every employee. And that’s not all: a Vanta spy program is forcibly installed on the work laptop of every programmer and admin, checking around the clock whether the computer has a password enabled, whether the antivirus is running and whether the update has been downloaded.
Formally, the access is “read-only” — someone else’s script won’t wipe your database on its own. But on the servers of the outside outfit, a complete X-ray map of the company is lovingly assembled: blueprints of the whole network, the names and emails of every engineer, their laptop models and a live list of every unpatched vulnerability.
Form-jockeys at the helm of global security
So who, you might wonder, are the hard-nosed cryptography geniuses and cyber-warfare veterans whom thousands of companies around the world trust with the keys to their back kitchen?
We open the bios of Vanta’s leadership and grab the popcorn.
The founder and permanent head of the company is Christina Cacioppo. Where did she forge her legendary information-security experience? In secret Pentagon labs? Building protection for banking cores? No. The young woman went off to learn to code, spent a couple of years tinkering with some small projects that never took off, and then landed a job as a product manager at Dropbox. And there she wasn’t even in charge of file storage or disk encryption. The peak of her career was Dropbox Paper — a secondary little online notepad for writing notes together inside a file-sharing service, whose existence nine out of ten Dropbox users never even suspected. While she was churning out that little notepad, she was made to fill in boring spreadsheets for auditors — and she decided it was far more profitable to sell other companies little web forms for automatically collecting those very same spreadsheets.
Let’s keep looking: who’s the other leading lady on this ship? Chief Marketing Officer Sarah Scharf. This lady came from Google, where for seven years she did “product marketing for privacy, security and Android.” Just think about the job itself: this person didn’t write code and didn’t catch hackers — for seven years she wrote advertising fairy tales about how Google cares about your privacy while it compiled a dossier on every inhabitant of the planet.
The rest of the team is a match: the chief product and technology officer used to run secondary add-ons and storefronts at GitHub, and the chief financial officer came from Calendly — a site that makes little forms for booking a call in your calendar.
This dream team — the creator of a cloud notepad, a Google PR woman for “privacy” and a bean counter from an online calendar — now hands out security standards to the world’s fintech.
A watchman in slippers and the paradox of office salespeople
But the real comedy starts when you look at how the back kitchen of the “inspectors” themselves is set up. The company that keeps snapshots of the vulnerabilities of thousands of other businesses officially works in “remote-first” mode. Back in spring 2022 they were cheerfully writing on their site: “These days, we work successfully from anywhere.”
If you visit their job board right now, 52 of the 83 openings are fully remote across the US, Canada, the UK and Ireland. And the people working from the couch there are not icon designers at all:
- Sr. Manager, Security Operations (Remote). This person sets up Vanta’s own defenses and commands the response to hacker attacks. The job ad thoughtfully promises a “Remote workspace, internet, and cellphone stipend.” The chief of fending off cyberattacks runs the defense through a home router, on the house.
- GovCloud government cloud engineer (Remote, with incident on-call). The only security requirement for working with the public sector is logging in “physically from within the United States.” Which roadside diner or rented apartment exactly — nobody cares.
- Senior Engineer, Enterprise Resilience and Senior Security Engineer (Remote). The people responsible for keeping production alive, who swear in the job ad that they keep Vanta “a trustworthy steward of sensitive data,” are sitting at home too.
- Staff Engineer, Program Structure & Trust (Remote). And remember this position in particular: this remote specialist is responsible for making sure different customers’ secret data doesn’t get mixed up.
Do you know what the main absurdity is here? Vanta’s bosses make ordinary sales managers in London and Dublin come into the office three days a week. So people who just phone clients and show slide decks have to sit under supervision in a business center. Meanwhile, the engineers holding the keys to production and the infrastructure maps of thousands of companies sit in slippers in their home kitchens, surrounded by relatives, neighbors, couriers and plumbers. And this at a time when American IT companies are catching fake remote workers by the dozen — when a hired stand-in sits the video interview, and the work laptop is mailed straight to a farm of North Korean hackers.
Four days with the fly wide open
Where security from notepad creators and remote workers on home Wi-Fi leads didn’t take long to find out.
Remember the job ad for the remote engineer who is supposed to make sure different companies’ databases don’t get mixed up? In May 2025, the form-jockeys at Vanta rolled out a botched update, and some customers’ secret data was simply written into other customers’ dashboards (incident report INC-868).
The secrets of hundreds of companies just spilled onto strangers’ screens. Outsiders got lists of other companies’ employees, their job titles and — the cherry on top — their two-factor authentication (MFA) settings. In other words, a ready-made cheat sheet for a break-in: who does what and whose account protection isn’t switched on.
But the full scale of this clown show is revealed by two details:
- The hole stayed open for four days. Vanta’s much-vaunted automated monitoring, which paints green checkmarks on customers’ websites every four minutes, spent four days failing to notice, right under its nose, that it was handing out other people’s databases to random neighbors. The bug was found only when one of the stunned customers saw someone else’s back kitchen in their own dashboard and wrote to support.
- Textbook chutzpah. When the disgrace came out, Vanta’s marketers published a report and, with a perfectly straight face, called the leak of hundreds of companies’ data into strangers’ hands a “non-security related” incident. So what if the databases got mixed up — what matters is that the checkmarks in the reports are green!
A paper shield
So that’s all the formidable SOC 2 Compliant and GDPR Compliant buttons in a website footer are worth.
An ordinary person looks at these badges and thinks their service is protected like the nuclear football. In reality, for the sake of a bureaucratic piece of paper, companies cut a hole in their own wall themselves, dump the whole blueprint of their defenses into one shared trough for former notes-and-advertising managers, and put people on home routers in charge of guarding that trough — people whose software can’t even notice that for four days straight it has been handing out other people’s secrets left and right.
The lessons of security without the security have been learned perfectly: the badge on the website shines, and what’s behind the door — better nobody knows.
In lieu of an epilogue: who a “remote security engineer” is in real life
When corporations put the phrase Remote Security Engineer into their presentations, the customer pictures a focused pro in a sunlit office guarding other people’s secrets over a secure satellite link.
In reality, a remote worker is a black box whose contents the employer doesn’t control in any way at all. Companies have no idea what happens on the other side of the webcam once the fifteen-minute morning call is over. And what happens there is real life in all its glory.
1. A fogged-up mind, SSRIs and mushroom microdosing In an office you at least see the person in the flesh: whether his hands are shaking, whether his eyes look sane, whether he has showered this week and whether he talks to the walls. Remotely, all contact with a person who holds root access to the servers of thousands of companies comes down to a little square in Zoom with a blurred background.
For fifteen minutes a day at stand-up, this guy forces out a perfunctory smile and briskly reports: “No blockers, pushing the update to prod.” Then he switches off the camera — and nobody at headquarters has any idea what state he’s in. Maybe he’s been on horse doses of heavy antidepressants (SSRIs) for three months, which have completely atrophied his sense of danger, and he couldn’t care less which databases he leaks where. Maybe, Silicon Valley style, he started the morning with a microdose of psilocybin mushrooms, or he’s on Adderall mixed with ketamine therapy, trying to pull himself out of post-divorce depression. To the company he’s a green dot in Slack. In fact, sitting at the controls of a nuclear reactor is a person in deep cognitive defocus.
2. A stick-up in a coffee shop and an open MacBook American tech hubs like San Francisco, Seattle or Austin long ago turned into crime theme parks. San Francisco even has a whole street trade — laptop snatching: robbers burst into trendy coffee shops, snatch open, unlocked MacBooks with VPN sessions already up and terminals open right out of techies’ hands, and carry them off to a car waiting at the door.
Or even simpler: in the evening after work, this “steward of sensitive data” goes out for a burrito with his work phone and laptop in his backpack. A couple of blocks from home, two guys with a gun come up to him, hit him over the head and explain in plain terms that right now he will not only hand over all his gear, but also put his finger on Touch ID and read out his PIN. No cloud firewall and no SOC 2 Compliant badge has ever saved anyone from a pipe in a dark alley.
3. Wives, lovers and access stolen right off the pillow Even if the engineer never leaves the house, his apartment is a revolving door. Behind his back walk wives, ex and current girlfriends, roommates in the rental, cleaners, couriers and guests at Friday parties.
In the US this is no longer theory but court records. In 2024, the Securities and Exchange Commission (SEC) busted a lovely family scheme: the husband of a remote employee of oil giant BP simply walked around the house and shared hotel rooms with her on trips while she worked from home on confidential merger deals. He eavesdropped on her calls, peeked at the open screen of her work laptop while she stepped into the kitchen, bought up shares of the right chain and made almost two million dollars on insider information.
Now picture a more down-to-earth scenario: a remote security engineer in the middle of a messy divorce or a fight with his other half. The aggrieved wife or an enterprising roommate just waits until the “guardian of the infrastructure” goes into the shower or falls asleep, photographs the open screen with access keys, tokens and Slack chats on a phone — or simply plugs a flash drive into the owner’s laptop, whose password they spotted over his shoulder long ago.
4. Three a.m. fatigue And finally, the classic that in recent years has burned giants from Uber to the authentication service Okta. When attackers buy a remote employee’s stolen password, all that’s left is to get around two-factor authentication (MFA). What do they do? They wait until the remote worker goes to bed at home, and at three in the morning they start bombarding his phone with dozens of push notifications: “Confirm sign-in.” Then they message him on his personal messenger posing as “company tech support”: it’s just a system glitch, tap “Confirm” so the notifications stop ringing. And the sleepy guy in his underwear, just so the phone finally shuts up and lets him sleep, lets the hackers into the holy of holies with his own finger.
This human chaos — pills, family dramas, street crime and nighttime sloth — is what the foundation of the entire modern “cloud trust” industry actually rests on. And the next time you see stern SOC 2 Compliant and GDPR Compliant badges at the bottom of a beautiful financial website, just remember that somewhere across the ocean, right now, a tired person on antidepressants has stepped away from an open laptop to pour himself a coffee while his girlfriend pensively scrolls through lists of other people’s servers on his monitor.