Security
How We Protect Your Data
Your exchange keys and account data are sensitive. Here is exactly what we do to keep them safe — no vague promises.
AES-256
at rest
TLS 1.3
in transit
No Withdrawal
API key scope
HttpOnly
session cookies
1. Encryption at Rest
Database Encryption
All account data, signal logs, alert configurations, and user settings are stored in PostgreSQL on infrastructure that enforces full-disk encryption at rest. Database backups are encrypted separately before being written to storage.
API Key Encryption
Exchange API keys and secrets are never stored in plaintext. Each key is encrypted with AES-256-GCM using per-user derived encryption keys. The encryption key itself is never stored alongside the ciphertext.
Decryption Scope
API key decryption occurs only within the isolated trade execution process, only when a bot order needs to be submitted, and only for the specific exchange key being used. Decrypted keys are held in memory only for the duration of the request.
2. Encryption in Transit
TLS 1.3
All connections between your browser and our servers use TLS 1.3. Older TLS versions (1.0, 1.1) and weak cipher suites are disabled. HTTPS is enforced with HTTP Strict Transport Security (HSTS) headers.
API Connections
All outbound connections to exchanges and external data providers use TLS with certificate pinning where supported. We do not make plaintext HTTP requests to any data provider.
3. API Key Security
No Withdrawal Permissions
We enforce that connected API keys must not include withdrawal permissions. During key setup, we warn if the key appears to have withdrawal access and recommend you regenerate it with trading-only scope.
Scope Isolation
Each API key connection is scoped to a single exchange and a single user. There is no pooling or sharing of keys between users or bots. A key for exchange A cannot be used to place orders on exchange B.
Key Rotation
You can revoke and replace your API keys from Settings to Exchanges at any time. Old keys are immediately marked inactive and cannot be used for new orders.
4. Authentication & Sessions
JWT Session Cookies
Authentication tokens are stored as HttpOnly, Secure, SameSite=Strict cookies. They are not accessible to JavaScript and cannot be stolen via XSS. Tokens expire after 24 hours of inactivity, or 30 days with Remember me.
OAuth Security
OAuth flows (Google, GitHub) use PKCE and state parameters to prevent CSRF and authorization code interception attacks. We receive only the minimal profile scopes required for account creation.
Password Hashing
Passwords are hashed using bcrypt with a work factor of 12 before storage. We never store or transmit plaintext passwords at any point.
5. Infrastructure
Network Isolation
The database and worker services are not exposed to the public internet. All internal service communication happens over a private network. The API server is the only public-facing entry point.
Dependency Security
We run automated dependency vulnerability scans on every deployment. Critical-severity CVEs in dependencies are patched within 48 hours of disclosure.
Secret Management
Production secrets (database credentials, encryption keys, API provider tokens) are injected at runtime via environment variables from a secret manager. Secrets are never committed to source control.
6. Responsible Disclosure
Reporting a Vulnerability
If you discover a security vulnerability in CryptoSignal Pro, please email security@cryptosignalpro.com with details. Do not publicly disclose the issue until we have had the opportunity to investigate and patch it.
What to Include
Please include: a description of the vulnerability, steps to reproduce it, the potential impact, and any proof-of-concept code. The more detail you provide, the faster we can assess and remediate.
Response Timeline
We will acknowledge your report within 48 hours, provide an initial assessment within 5 business days, and keep you informed of remediation progress. We credit researchers who report valid vulnerabilities (with their permission).
Found a vulnerability?
Email our security team — we respond within 48 hours.
General security questions?
Contact Support