In plain English
- We never ask for or store your broker password, and AI models cannot call your broker.
- Defence in depth: encryption, phishing-resistant MFA for staff, least privilege, a tamper-evident audit log and independent testing.
- Nothing is unhackable, so we plan for incidents: detection, containment, key rotation and prompt notification.
- Found a vulnerability? Report it to security@algonexus.trade. We won’t pursue good-faith research.
The summary helps you navigate; the sections below are the document.
1Your money and broker access
- We connect through official broker authorisation flows and never ask for or store your broker password, PIN or TOTP secret.
- Broker tokens are encrypted with cloud-managed keys and can be revoked by you at any time, from Settings or at your broker.
- AI models cannot call your broker. Only the risk-checked order service can, and only within your policy.
- New-device alerts, and cooling-off periods for sensitive changes such as new broker connections.
2Platform controls
- TLS in transit; AES-256 encryption at rest; managed keys with rotation.
- Passkeys or MFA for customers; mandatory SSO with phishing-resistant MFA for staff.
- Role-based access with two-person approval for sensitive actions; hash-chained, tamper-evident audit log.
- Signed builds, software bill of materials, dependency and container scanning, default-deny network policies.
- Built to OWASP ASVS level 2 (level 3 for authentication and order flows).
3Support access you can see
- Support can view your account only read-only, for a limited time, with a recorded reason and ticket.
- Every view appears in Settings → Security activity, and MCP access is paused while it happens.
4Assurance roadmap
- Independent penetration test before live trading, then at least annually.
- SOC 2 Type I, then Type II; ISO/IEC 27001 certification. We will say “certified” only once a certificate is issued.
- Public status page at status.algonexus.trade and a paid bug-bounty programme.
5If something goes wrong
We maintain a tested incident-response plan. If an incident affects your data or account, we will tell you what happened, what it means for you and what we are doing, and notify regulators within the deadlines that apply (for example 72 hours under the GDPR and 6 hours for reportable incidents to CERT-In in India).
6Responsible disclosure policy
We welcome reports from security researchers. Email security@algonexus.trade (our security.txt lists contacts). Please include the affected URL or component, steps to reproduce and the impact you observed.
In scope
- *.algonexus.trade web applications and APIs
- The AlgoNexus iOS, Android and desktop apps
- The MCP server
Out of scope
- Denial-of-service, volumetric or rate-limit testing
- Social engineering of staff or customers; physical attacks
- Brokers’ and other third parties’ systems
- Reports from automated scanners without a demonstrated impact
Rules
- Use only accounts you own or test accounts we provide. Never access, modify or keep other people’s data; if you encounter it, stop and tell us.
- Never place real-money orders. Use paper accounts.
- Give us reasonable time to fix the issue before public disclosure (normally 90 days).
Our commitments
- Acknowledge within 2 business days; initial assessment within 5 business days; regular updates until fixed.
- We will not take legal action against, or ask law enforcement to investigate, good-faith research that follows this policy.
- Public credit if you want it, and rewards once the bug-bounty programme opens.