Security
Security is built into the platform at every level. We use layered controls across authentication, application access, transaction processing, and financial data to help protect accounts, trading activity, and user information.
- Passwords are securely hashed using PHP's
password_hash()and are never stored in plain text. - Every state-changing request is protected against Cross-Site Request Forgery (CSRF).
- Sessions use secure
HttpOnlyandSameSitecookies with appropriate domain and scope controls. - Sensitive account and administrative functions require appropriate authentication and authorization checks.
- The trading environment and administrative interfaces are logically separated from the public-facing application to reduce unnecessary exposure.
- User input and transaction parameters are validated server-side before sensitive operations are processed.
- Financial operations are processed through controlled, atomic ledger transactions designed to maintain consistent account balances.
- Balance changes are recorded through the platform's ledger rather than unrestricted direct database updates.
- Deposits, withdrawals, trades, fees, and other account movements are recorded in the transaction history for transparency and reconciliation.
- Administrative functionality is restricted from public access and protected by additional access controls.
- Sensitive credentials, application secrets, and authentication information are not exposed through the client application.
- Security-relevant events and financial operations are logged where appropriate to support monitoring, investigation, and auditing.
- Security controls and infrastructure are regularly reviewed and improved as the platform evolves.
No online service can guarantee absolute security. Users should protect their credentials, use a unique password, enable multi-factor authentication where available, and never share passwords or authentication codes with anyone.