01
Secure infrastructure
Application data is stored in a managed database with hashed passwords and server-side authorization.
Security
The portal is designed with authenticated access, ownership checks and audit history. No certification is claimed unless independently obtained.
02
Encrypted communication
Production deployments should be served over HTTPS. Transport encryption depends on the hosting environment.
03
Access controls
Administrators and clients have separate areas. Clients cannot open another client's records by changing a URL.
04
Authentication
Sessions use httpOnly cookies, expiration and a password-reset flow. Two-factor fields are reserved on the user model.
05
Account monitoring
Failed logins and last-login metadata are stored for review.
06
Data protection
Documents are stored outside the public web folder and served only after ownership checks.
07
Audit history
Administrative changes to clients, portfolios, trades and cash are written to an append-only audit log.