Security
Protect the account. Bound every integration. Fail closed.
TraderBase uses layered controls around accounts, private resources, provider integrations, and production configuration. This page describes current engineering principles; it does not claim a certification or substitute for a completed independent assessment.
Security controls
Identity and authorization
Private routes require authentication, and server handlers re-check account status, resource ownership, and plan access beside protected data operations. Navigation middleware is not treated as authorization.
Bounded integrations
Provider credentials remain server-side. Signed webhooks, request-origin checks, bounded inputs, rate limits, and fail-closed production gates reduce untrusted access and unintended side effects.
Data minimization
Optional telemetry requires consent and is restricted to approved public routes with query strings removed. Sensitive journal, chat, billing, owner, and uploaded-content values are excluded from marketing analytics.
Scope and transparency
What this page does not claim.
- TraderBase does not currently publish a SOC 2, ISO 27001, or penetration-test certification.
- No public bug-bounty or safe-harbor program is represented as active.
- Operational recovery objectives and external incident ownership remain launch-gated decisions.
- Security controls reduce risk; they cannot guarantee that a service will never experience an incident.
Responsible reporting
Report a suspected security issue privately.
Use the contact form and choose the closest available security or account category. Do not include passwords, provider credentials, full payment data, private keys, or unnecessary personal information. A formal vulnerability-disclosure channel will be published only after its owner and response process are approved.
Contact TraderBase