Data Security & Credential Handling
Security is core to a platform that connects to your brokerage account. We never take custody of your funds, and we treat broker credentials as our most sensitive data. This statement summarises how we protect your information.
1. Broker credential handling
- Encryption at rest: broker API keys/secrets are encrypted using strong, industry-standard symmetric encryption (AES via Fernet) with keys managed in a dedicated key-management service; secrets are never stored in plaintext.
- Encryption in transit: all traffic uses TLS.
- Least privilege: we request only the broker scopes needed to operate your bots; where a broker offers trade-only (no-withdrawal) permissions, we use them.
- Isolation: credentials are isolated per user and accessible only to the components that execute your bots.
- No withdrawal rights: our access cannot move or withdraw funds from your broker account.
- Revocation: you can disconnect your broker at any time, which revokes our access; tokens are invalidated.
2. Infrastructure & access
- Hosting with reputable EU/EEA providers; bot execution runs in isolated environments.
- Role-based access control and the principle of least privilege for staff; access is logged.
- Multi-factor authentication for administrative access; key secrets held in a secrets manager.
- Network controls, hardening, and regular patching.
3. Application security
- Hashed, salted passwords and secure session management; CSRF protection.
- Input validation and protections against common web vulnerabilities.
- Append-only, audited execution logs for orders and system events.
- Dependency and vulnerability management; periodic security testing.
4. Monitoring, backups & resilience
- Logging and monitoring of platform and bot activity, with alerting on anomalies.
- Encrypted backups and a defined recovery process.
- Rate limiting and abuse prevention.
5. Incident response
We maintain an incident-response process. In the event of a personal-data breach, we will assess, contain and remediate, and notify affected users and the supervisory authority (Autoriteit Persoonsgegevens) where legally required, in line with our Privacy Policy.
6. Your part
Use a strong, unique password and enable MFA; grant the narrowest broker permissions that work; disconnect brokers you no longer use; and keep your own devices secure. Report security concerns to security@vqs.ai.