Application Controls and
Deployment Requirements.
Implemented controls reduce risk around sessions, broker credentials, user-owned resources, and private statement storage. Hosting, TLS, backups, and recovery must be verified in the deployed environment.
Defense in Depth
Implemented application controls, with hosting and operational controls verified separately.
Data At Rest
Sensitive broker credentials use authenticated AES-256-GCM encryption. Private S3 statement objects require server-side encryption; database and backup encryption depend on the selected hosting provider.
Data In Transit
Production deployment requires HTTPS. Refresh sessions use Secure, HttpOnly, SameSite cookies and explicit credentialed CORS origins.
Strict Access Control
Backend ownership checks scope accounts, trades, profiles, and files to the authenticated user. Admin routes require an explicit admin role, and refresh sessions are stored as hashes.
Tenant Isolation
User IDs, account ownership, database constraints, and provider-aware storage keys enforce logical tenant boundaries. These controls are covered by cross-user regression tests.
Your Data. Your Business.
FX Data Lab is analytics software, not a broker, exchange, hedge fund, or trade-execution service. Privacy terms and production subprocessors must be finalized before public launch.
Deployment Requirements
Deployment-Dependent Availability
Availability, redundancy, backups, and recovery objectives depend on the selected production provider and must be verified before launch.
Abuse and Input Controls
Explicit origin checks, route rate limits, strict file validation, and audit events reduce common abuse paths. Provider-level DDoS controls remain a deployment requirement.
Backup Verification Required
The release checklist requires encrypted backups and a tested restore. The application does not claim backups exist until the operator verifies the deployed environment.
Security Requires Verified Operations
Application controls reduce risk, but operators must verify HTTPS, secrets, storage, backups, monitoring, and recovery before launch.