Paper trading only — live trading is locked.
Security
Controls that are running in the product today.
Passwords
Hashed with Argon2; login is rate limited.
Sessions & CSRF
HttpOnly SameSite session cookie plus a double‑submit CSRF header on every write.
MFA
TOTP (RFC 6238), required for risk officer, admin and super admin roles.
Access control
Roles: viewer, trader, risk officer, admin, super admin.
Isolation
One isolated database per tenant workspace.
Secrets
Broker keys and webhooks encrypted with AES‑GCM and only ever displayed masked.
Audit
Append-only audit log with a SHA‑256 hash chain and a verification endpoint.
Live trading
The live trading route does not exist; attempts are refused and audited.