1. Transit & Rest Security
All data transmitted between the EdgeSpine client and our databases is encrypted in transit using Transport Layer Security (TLS 1.3).
At rest, databases are hosted on enterprise-grade cloud systems with AES-256 block-level storage encryption, ensuring physical and backup volumes cannot be read without cryptographic keys.
2. Data Isolation & RLS
We leverage PostgreSQL Row-Level Security (RLS) as our primary kernel-level defense-in-depth security architecture. RLS enforces strict, non-bypassable ownership barriers directly inside the database engine:
- 100% Table Coverage: Every single table housing user portfolios, trading logs, custom rules, geopolitical analytical cache, push subscriptions, and screenshot hashes is locked behind explicit ownership policies.
- Cryptographic Verification: Authenticated operators carry signed JSON Web Tokens (JWTs) or WebAuthn/Passkey sessions that are verified by the database kernel on every query.
- Zero Cross-Tenant Leakage: Even if an API request attempts to query or modify another operator's portfolio or trade execution records, the database kernel drops the request automatically.
3. Network & Edge Protection
EdgeSpine sits behind a robust Content Delivery Network (CDN) and Web Application Firewall (WAF) layer provided by Cloudflare:
- DDoS Mitigation: Active, automated volumetric filtering prevents denial-of-service attacks from disrupting live trading logs.
- CORS & Origin Guards: Cross-Origin Resource Sharing rules and origin checking prevent unauthorized websites from executing scripts or fetching resources in your session.
- Content Security Policy (CSP) & XSS Hardening: We enforce strict CSP headers to restrict script execution to verified domains, eliminating Cross-Site Scripting (XSS) and code injection vectors.
4. Logging, Secret Gating & Cookie Security
We practice rigorous data hygiene across our client app and serverless cloud edge:
- Secret Gating: To prevent sensitive tokens from leaking into unencrypted browser memory or local cache, sensitive credentials (such as account webhook tokens) are completely excluded from initial client-side account queries. They are only retrieved on-demand when explicitly managing connection configurations.
- PII & Token Redaction: High-risk parameters—such as brokerage credentials, PWA push endpoints, and webhook tokens—are automatically redacted by our log filtering system before logs are written.
- Cookie Session Security: Session tokens are chunked across secure, HTTP-only cookie structures with strict protection flags. This prevents token truncation on large sessions while shielding operator credentials from third-party script exfiltration.
- Immutable Audit Trail: All requests targeting edge API endpoints are logged as append-only traffic audit records, which are automatically purged after 90 days.