shield SECURITY & TRUST

Security & Trust

How we protect your data. Every control below is implemented in the platform today. Last reviewed: November 2026.

      We never custody your assets and never sell your data. INDYXQUANT is analytics software: your money stays at your own broker/custodian (Schwab, Fidelity, and others), and your financial data is used only to provide your analytics.
    

Authentication & access control

check_circle

Session tokens in httpOnly cookies

Sessions are JWTs (HS256, algorithm-pinned) stored in httpOnly cookies. Sign-in responses never hand the token to the browser (only the mobile app receives it), so page scripts cannot read it.

check_circle

Passwords hashed with bcrypt

Passwords are salted and hashed with bcrypt (12 rounds). We never store or log plaintext credentials.

check_circle

Two-factor authentication

Optional TOTP 2FA via authenticator apps, with encrypted secrets and single-use backup codes.

check_circle

Per-user data scoping

Portfolio and client queries are scoped by user id in the application, and a tenant guard blocks any signed-in request that reads or writes another user’s records. Database row-level security is written and tested but not yet switched on.

check_circle

Rate limiting on sensitive endpoints

Dedicated rate limiters protect login, 2FA verification, registration and password reset against brute force, with further limits on AI, export and market-data calls.

check_circle

OAuth sign-in, minimal scope

Optional Google / GitHub / LinkedIn sign-in receives only basic profile information, no access to your other accounts.

Data protection

check_circle

Sensitive fields encrypted in the database (AES-256)

Advisor client emails and phone numbers, account and policy numbers, dates of birth, stored AI keys and 2FA secrets are encrypted with AES-256 before they are written to the database. Your sign-in email is not encrypted, because it is used to look up your account.

check_circle

TLS in transit + HSTS

Traffic is served over TLS 1.2 or 1.3 with HSTS (includeSubDomains) enforcing HTTPS-only connections.

check_circle

Parameterized queries

Queries run through the Prisma ORM or parameterized SQL, with user input passed as bound parameters.

check_circle

Strict Content Security Policy

Helmet-enforced CSP: nonce-only inline scripts, no inline event handlers, object-src none, form-action self, and frame-ancestors self to block clickjacking.

Infrastructure

check_circle

AWS hosting

Production is deployed on AWS, whose underlying infrastructure holds ISO 27001 and PCI DSS certifications.

check_circle

Nightly backups

The PostgreSQL 16 database is dumped nightly and each dump is kept for 30 days, so it can be restored to any of those nightly copies.

check_circle

Isolated, containerized services

Backend, frontend, database, and cache run as isolated containers behind a connection-pooled database (PgBouncer) and TLS-terminating reverse proxy.

Monitoring & secure development

check_circle

Security audit logging

Admin actions (session revocations, password resets, account and API-key changes) go to a security-events log, and password, 2FA and session changes go to your own account audit log.

check_circle

Sanitized error responses

A global response sanitizer strips stack traces, internal paths, and schema details from API errors before they leave the server.

check_circle

Secret scanning before commit

Pre-commit hooks (gitleaks, private-key and AWS-credential detectors) block hardcoded API keys, credentials and private keys before they are committed.

check_circle

Data provenance, labeled honestly

Estimated, modeled, reference and live values carry EST / MODELED / REF / LIVE badges, so you can tell what is measured and what is assumed.

Certifications & roadmap

We are transparent about what is done versus in progress:

You own your data — export it anytime (CSV / Excel). Deleting your account removes your personal data at once; copies inside nightly backups expire with those backups.
No asset custody — we are software, not a broker-dealer or custodian; your assets remain with your own institution.
Vendor due diligence — advisors can file our vendor due-diligence brief for compliance reviews.

Security question or want to report an issue? Email security@indyxquant.com. We respond to security reports promptly.