Cybersecurity Policy

Data Handling Principles

• Least privilege: Data is only accessible to individuals and systems that require it for their function
• Need-to-know: Access to Confidential and Restricted data requires explicit business justification
• Retention limits: Data is retained only as long as needed for its stated purpose and then securely deleted
• Secure disposal: When data is no longer needed, it is irreversibly deleted from all storage media

Authentication

• All user accounts require strong, unique passwords with a minimum complexity standard
• Multi-factor authentication (MFA) is required for all internal administrative access and recommended for all user accounts
• Sessions are time-limited and automatically expire after periods of inactivity
• Authentication is managed through our database provider's built-in identity and access management service, which includes protection against brute-force and credential-stuffing attacks

Authorization & Role-Based Access

• All access is granted on a role-based model — users receive only the permissions needed for their role
• Row-level security is enforced at the database layer so that users can only access their own data
• API endpoints validate authentication tokens on every request before processing
• Service-to-service communication uses scoped credentials with minimal permissions

Privileged Access Management

• Administrative access to production infrastructure is restricted to a minimal set of authorized personnel
• Privileged credentials are rotated regularly and stored in a managed secrets service — never in source code or configuration files
• All privileged actions are logged and auditable
• Infrastructure changes are deployed through code-reviewed, version-controlled pipelines (Infrastructure as Code) rather than manual access

Data in Transit

• All external communication is encrypted using TLS 1.2 or higher — HTTP traffic is automatically redirected to HTTPS
• API communications between our services and third-party exchanges are encrypted end-to-end
• Internal service-to-service traffic within our cloud infrastructure uses encrypted channels

Data at Rest

• All database storage is encrypted at rest using AES-256 encryption managed by our cloud and database providers
• Backups are encrypted with the same standards as primary storage
• Exchange API keys and other Restricted-tier secrets are additionally encrypted at the application layer before storage

Key Management

• Encryption keys are managed through our cloud provider's key management service
• Keys are rotated on a defined schedule and access is tightly controlled
• Application-level secrets are stored in managed secrets infrastructure, not in code

Vulnerability Identification

• Automated dependency scanning runs on every code change to detect known vulnerabilities in third-party packages
• Container images and infrastructure configurations are scanned for security misconfigurations
• We subscribe to security advisories for all major components in our stack

Patch Management

• Critical vulnerabilities (actively exploited or high CVSS) — patched within 24–48 hours
• High-severity vulnerabilities — patched within 7 days
• Medium/low-severity vulnerabilities — addressed in the next scheduled maintenance cycle
• All patches are deployed through our standard CI/CD pipeline with automated testing

Secure Development

• All code changes go through peer review before merging
• Automated security linting and static analysis run as part of the CI pipeline
• Sensitive operations (payments, credential handling) receive additional security-focused review

Notification

• Users affected by a data breach are notified within 72 hours of confirmed impact, in accordance with applicable regulations
• Notifications include a description of the incident, data potentially affected, and recommended actions
• Relevant regulatory bodies are notified as required by law

Infrastructure Resilience

• Core services are deployed across multiple geographic regions for redundancy
• Automated health checks and failover mechanisms redirect traffic away from unhealthy instances
• Database replicas are maintained in separate availability zones with automated failover

Backup Strategy

• Databases are backed up continuously with point-in-time recovery capabilities
• Backups are encrypted and stored in a geographically separate location
• Backup restoration is tested periodically to verify data integrity and recovery time

Recovery Objectives

• Recovery Time Objective (RTO): Services are designed to recover within hours, not days
• Recovery Point Objective (RPO): Data loss is limited to minutes through continuous replication
• Recovery procedures are documented and periodically tested

Vendor Selection

• Vendors must demonstrate compliance with recognized security standards (e.g., SOC 2, ISO 27001)
• We evaluate vendor security posture, data handling practices, and incident response capabilities before onboarding
• Preference is given to vendors that offer encryption, audit logging, and fine-grained access controls by default

Ongoing Monitoring

• Vendor compliance certifications and security posture are reviewed at least annually
• We monitor vendor security advisories and incident disclosures
• Data shared with vendors is limited to the minimum necessary for the service

Data Processing Agreements

• All vendors that process user data are bound by data processing agreements specifying security requirements, breach notification obligations, and data handling restrictions
• Vendor access to production data is restricted and auditable

• All team members are required to use multi-factor authentication on all company accounts and tools
• Access to production systems is granted on a need-to-know basis and reviewed quarterly
• Security awareness training is provided to all team members, covering phishing, social engineering, and safe data handling
• Offboarding procedures include immediate revocation of all access to systems, repositories, and infrastructure
• Company devices are required to have full-disk encryption, automatic screen lock, and up-to-date operating systems