Trust
Security
This page describes principles. It deliberately omits operational detail that would help somebody attack the platform.
Short-lived sessions
Access tokens are minutes-long and refresh tokens rotate; reuse of a spent token invalidates the family.
Multi-factor authentication
Time-based codes with replay protection and single-use recovery codes.
Credentials the browser cannot read
Session credentials live in httpOnly cookies. A script in the page cannot take them elsewhere.
Encrypted storage on mobile
The mobile application keeps credentials in the platform keychain, device-only.
Tenant isolation
Every read and write is scoped to a workspace and re-authorised on the server.
Server-authoritative decisions
Risk and sizing are computed server-side. A client cannot argue its way to a larger position.
Audit architecture
Security-relevant events are appended, never rewritten.
Protected origin
Traffic reaches the platform through a hardened edge over HTTPS only.
We do not publish a phone number or postal address.