SECURITY
What is protected, and what is not yet.
An honest account: the controls that exist today, and the ones still to come before launch.
In place today
- Sign-in without passwords. Invited investors and staff get a 6-digit code by email. Codes are stored only as hashes, expire in 10 minutes, allow five wrong guesses and work once. The sign-in form gives the same answer whether or not an address is registered.
- Sessions you can end. A random session token lives in an httpOnly cookie; the server keeps only its hash, so a database leak does not yield usable sessions. Staff can sign an investor out everywhere, and staff access ends when an address leaves the allow-list.
- Private documents. Documents are stored in the database, not in a public folder, and served only to a signed-in person who is allowed to see that document, never cached.
- Abuse protection. Registration and sign-in are rate limited in the database, with a hidden trap for bots, and every number is recomputed on the server.
- An audit log records sign-ins, submissions, changes and document views.
- Browser protections. Security headers and a Content-Security-Policy allow scripts only when they carry a one-time token for that page view, and block plug-ins, framing and any resource from another site.
- Nothing third-party is loaded. Fonts and other assets are self-hosted, so no outside company sees who visits.
- No payments are taken here, and no card or bank details are collected.
Still to come before launch
- An authenticator-app step for staff sign-in, in addition to the emailed code.
- Per-investor watermarking of documents, and virus scanning of uploads.
- Independent vulnerability assessment and penetration testing.
- Rate limiting at the network edge, backups and a tested recovery plan.
- Compliance review under the Digital Personal Data Protection Act, 2023, and an incident-response process with breach notification.
- HTTPS enforced by the hosting platform, with certificates monitored.
Reporting a vulnerability
A security contact will be published here before the site goes live.
Related
See the privacy policy for how personal data is handled.