Security

Account security

• Passwords are hashed with a modern memory-hard algorithm; we never store or see them.
• A 12-character minimum with mixed character classes is enforced at registration.
• Two-factor authentication is available and strongly recommended for live-account clients.
• Sessions are held in HTTP-only, SameSite cookies and expire automatically.
• Every authentication event is logged and visible to you in your settings.

Data isolation

Client records are protected by row-level security at the database level, so a query can only ever return rows belonging to the authenticated user — even if an application bug tried to ask for more. Administrative access requires a separate credential, is granted to named individuals only, and is audit-logged.

Trading credentials

• We request the trading password only. We never request the investor withdrawal password or your broker client-area login.
• Credentials are encrypted at rest with a key stored outside the database, so a copy of the database alone is useless.
• Our setup engineer decrypts your trading password only to install and configure your robot. Every access is recorded in an append-only audit log naming the staff member, the account and the time. We can show you that record on request.
• No automated process, report or export ever includes a plaintext credential.
• You can revoke access instantly from your dashboard; the robot stops opening positions immediately.

Infrastructure

• TLS everywhere, with HSTS preloading and strict transport headers.
• Strict security headers: frame-ancestors, content-type sniffing protection and a locked-down permissions policy.
• Dependencies are monitored for known vulnerabilities and patched on a fixed cadence.
• Encrypted, tested backups with a documented restore procedure.

What we ask of you

• Use a unique password and enable two-factor authentication.
• Never send credentials by email or chat — we will never ask for them that way.
• Tell us immediately if you see a trade you do not recognise.

Reporting a vulnerability

Email security@aurumealab.com with details and a reproduction path. We aim to acknowledge within one business day. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and give us reasonable time to fix an issue before disclosure.