Information Security Policy

This policy covers the QuantCore platform at qntcore.ai, the data it processes (account data, order records, and the access tokens issued when you link a brokerage account), and every person, contractor and vendor that works on it or processes that data. The Chief Executive Officer owns this policy, approves production access and vendors, and leads incident response. Anyone can report a security concern to security@qntcore.ai.

• Restricted: brokerage access tokens, API secrets, encryption keys. Encrypted by QuantCore before storage, never logged, never displayed or returned by any API once saved, available only to the running application.
• Confidential: names, email addresses, risk settings, orders, positions, standing instructions and disclosure records. Stored only in the managed production database, sent only over TLS, and visible only to the user they belong to (checked server-side on every request).
• Internal: source code and configuration, kept in access-controlled systems.
• Public: published signals, the track record and this website.
• QuantCore never receives or stores your brokerage password. Card payments are handled entirely by Stripe and never touch QuantCore systems.
• Order, approval, standing-instruction, risk-gate and disclosure records are kept for seven years in append-only form. Unlinking a brokerage account overwrites its stored token.

• Production access is limited to named, approved people at the lowest role that works, with no shared accounts.
• Multi-factor authentication is required on every administrative account: hosting, source control, database, cache and queue, payments, email, storage and domain.
• Production secrets are held only in the hosting provider's encrypted environment store, never in source code.
• Access is revoked within 24 hours of someone leaving, with secrets they could see rotated. Privileged access is reviewed quarterly.
• In the app: email verification, rate-limited sign-in, server-validated sessions, and role and ownership checks on every API request. Brokerage features also require an active subscription and your recorded acceptance of the relevant disclosures.
• Linking a brokerage account uses the broker's OAuth flow with a signed, user-bound, 10-minute state value, and starts only after you acknowledge the authorization disclosure.

• In transit: qntcore.ai is served only over HTTPS (TLS 1.2 or higher), and every connection to the database, cache, queue, broker and data providers uses TLS.
• At rest: the database, cache and object storage are managed services that encrypt stored data (AES-256).
• Brokerage tokens and API secrets are additionally encrypted by QuantCore with AES-256-GCM under a dedicated key, with a random IV and authentication tag per value and no plaintext fallback. Keys can be rotated.

• The platform runs on managed serverless infrastructure: no long-lived servers or shell-accessible hosts, every deployment an immutable build, operating systems patched by the provider.
• Automated dependency updates propose library upgrades continuously; security advisories are reviewed as they arrive.
• Every change goes through source control with automated linting, type checking and tests before release.
• Remediation targets from confirmation: critical 72 hours, high 14 days, medium 60 days, low at the next scheduled maintenance.
• Production errors and performance are monitored continuously, with scheduled data-health checks that alert the team.

• Incidents are triaged by severity. Containment controls include switching off live brokerage connectivity platform-wide, suspending all standing instructions, an automatic trading halt, revoking stored tokens, rotating secrets, and rolling back to a previous deployment.
• Affected users, and any brokerage partner whose customers are involved, are notified without undue delay and within 72 hours of confirming an incident that affects their data or accounts; regulators where the law requires.
• A written review follows every serious incident, with corrective actions tracked to completion.
• The managed database keeps automated backups with point-in-time recovery; signal and track-record data is also archived daily to separate storage; the application can be redeployed to any prior version in minutes. Recovery targets: 4 hours (time) and 24 hours (data) or better.
• If market data, the broker or QuantCore itself is degraded, order transmission stops rather than proceeding on stale data. Your positions stay at your broker, under your control.

• QuantCore runs no data centers. Production is hosted by providers whose facilities are independently audited (for example SOC 2 Type II, ISO 27001).
• Work devices must use full-disk encryption, automatic updates, built-in anti-malware and firewall, and automatic screen lock; no production data is kept on them, and a lost device has its sessions and credentials revoked immediately.

Every vendor that processes QuantCore data is approved before use, after review of its security attestations and data-processing terms, and receives only the data its function needs. Critical vendors are reviewed annually. The current list is on the subprocessors page.

This policy is reviewed at least once a year and after any significant platform change or serious incident.