shield SECURITY & TRUST

Security & Trust

How we protect your data. Every control below is implemented in the platform today. Last reviewed: July 2026.

      We never custody your assets and never sell your data. INDYXQUANT is analytics software: your money stays at your own broker/custodian (Schwab, Fidelity, and others), and your financial data is used only to provide your analytics.
    

Authentication & access control

check_circle

Tokens never exposed to JavaScript

Sessions are JWTs in httpOnly cookies (HS256, algorithm-pinned), and the frontend proxies all API calls server-side so the token is never readable by page scripts, eliminating XSS token theft.

check_circle

Passwords hashed with bcrypt

Passwords are salted and hashed with bcrypt (12 rounds). We never store or log plaintext credentials.

check_circle

Two-factor authentication

Optional TOTP 2FA via authenticator apps, with encrypted secrets and single-use backup codes.

check_circle

Per-user data scoping

Every database query is scoped by user id, so one account can never read another's portfolio or client data.

check_circle

Rate limiting on sensitive endpoints

16 dedicated rate limiters protect login, registration, password reset, 2FA, and billing against brute-force and abuse.

check_circle

OAuth sign-in, minimal scope

Optional Google / GitHub / LinkedIn sign-in receives only basic profile information, no access to your other accounts.

Data protection

check_circle

PII encrypted at rest (AES-256)

Sensitive personal fields (email, phone, and similar) are encrypted at rest with AES-256 via a database-layer encryption middleware.

check_circle

TLS in transit + HSTS

All traffic is served over 256-bit TLS with HSTS (preload, includeSubDomains) enforcing HTTPS-only connections.

check_circle

SQL-injection safe by construction

All queries run through a parameterized ORM (Prisma); user input is never concatenated into raw SQL.

check_circle

Strict Content Security Policy

Helmet-enforced CSP: nonce-only inline scripts, no inline event handlers, object-src none, form-action self, and frame-ancestors self to block clickjacking.

Infrastructure

check_circle

Enterprise-grade cloud infrastructure

Hosted on AWS, whose underlying infrastructure holds ISO 27001 and PCI DSS certifications.

check_circle

Nightly encrypted backups

The PostgreSQL 16 database is backed up nightly, enabling point-in-time recovery.

check_circle

Isolated, containerized services

Backend, frontend, database, and cache run as isolated containers behind a connection-pooled database (PgBouncer) and TLS-terminating reverse proxy.

Monitoring & secure development

check_circle

Security audit logging

check_circle

Sanitized error responses

A global response sanitizer strips stack traces, internal paths, and schema details from API errors before they leave the server.

check_circle

Secret scanning in CI

Pre-commit and CI hooks (gitleaks) block hardcoded API keys, credentials, and private keys from ever reaching the repository.

check_circle

Data provenance, labeled honestly

Estimated, modeled, and live values are labeled throughout the product (EST / MODELED / LIVE), so you always know what is measured versus assumed.

Certifications & roadmap

We are transparent about what is done versus in progress:

You own your data — export it anytime (CSV / Excel), and deletion removes your personal data within 30 days.
No asset custody — we are software, not a broker-dealer or custodian; your assets remain with your own institution.
Vendor due diligence — advisors can file our vendor due-diligence brief for compliance reviews.

Security question or want to report an issue? Email security@indyxquant.com. We respond to security reports promptly.