Skip to main content

Security & Compliance

Security

Your capital and data, protected at every layer

Security is not a feature we bolt on โ€” it is how the platform is built, reviewed, and operated every day. Here is what that means in practice.

  • Encryption everywhere

    AES-256 at rest, TLS 1.3 in transit, and customer-managed keys on enterprise plans.

  • Independent audits

    Annual SOC 2 Type II audits plus continuous penetration testing by external researchers.

  • Least-privilege access

    Production access is time-boxed, peer-approved, and logged โ€” no standing admin credentials.

  • Transparent policies

    Public security whitepaper, 72-hour breach notification commitment, and a responsible disclosure program.

  • API key isolation

    Your exchange API keys are encrypted per-user and never shared across accounts or strategies.

  • Real-time monitoring

    24/7 intrusion detection, automated anomaly alerts, and incident response playbooks tested quarterly.

Independent assurance

Audited by third parties, on the record

  • SOC 2 Type II

    Deloitte & Touche LLP

    Security, availability, and confidentiality controls examined over a full 12-month observation period โ€” zero exceptions noted.

    March 2026

  • ISO/IEC 27001:2022

    BSI Group

    Information security management system certified across every engineering and support team.

    January 2026

  • PCI DSS Level 1

    Coalfire Systems

    Card-data environment assessed at the strictest service-provider level, renewed annually.

    November 2025

Licensed & regulated

  • Financial Conduct Authority

    United Kingdom

    FRN 902441

  • Commodity Futures Trading Commission

    United States

    NFA ID 0548372

  • Australian Securities and Investments Commission

    Australia

    AFSL 521847

  • Monetary Authority of Singapore

    Singapore

    CMS 101358

License numbers are public โ€” search any register above to confirm our standing directly with the regulator.