Cybersecurity Policy

Effective date: April 29, 2026

1. Overview

Quantago (operated by Universal Reason LLC, hereinafter “the Company”) is a cloud-native, edge-first SaaS platform that enables retail traders to build, backtest, and run automated trading bots connected to their own broker accounts. The platform runs entirely on Cloudflare’s global edge network and does not operate traditional on-premise servers.

This Cybersecurity Policy establishes the Company’s security controls, standards, and responsibilities to protect user data, platform integrity, and third-party integrations.

2. Data Classification and Handling

2.1 Data Categories

• Public Data — marketing content, public documentation, product descriptions. No access controls required.
• User Account Data — email addresses, usernames, hashed passwords, subscription status. Stored encrypted at rest; access restricted to authenticated sessions.
• Broker OAuth Tokens — third-party OAuth access tokens used to connect user broker accounts. Stored encrypted using AES-256 in Cloudflare KV and/or D1 with key rotation. Never logged, never transmitted in plaintext.
• Trading Strategy Data — user-authored strategy configurations and bot parameters. Treated as confidential user data; logically isolated per user.
• Operational Logs — platform usage and error logs. Stripped of PII before storage. Retained for 90 days maximum.

2.2 Data Handling Principles

• Data minimization: only data necessary for service delivery is collected.
• No data is sold or shared with third parties for advertising purposes.
• User data is logically isolated per account and not accessible across tenants.
• Broker credentials and API tokens are never stored in application logs or error reporting systems.

3. Access Control and Privileged Access Management

3.1 User Authentication

• All user accounts are protected by email/password authentication with bcrypt hashing (cost factor ≥12) or OAuth 2.0 SSO.
• Session tokens are short-lived (24-hour expiry) and cryptographically signed using industry-standard JWT or equivalent.
• Rate limiting is enforced on all authentication endpoints via Cloudflare WAF rules to prevent brute-force attacks.

3.2 Administrative Access

• The platform has no shared administrative accounts. All production access is tied to individual developer credentials.
• Cloudflare dashboard access is protected by hardware security key (WebAuthn/FIDO2) multi-factor authentication.
• Production secrets (API keys, OAuth client credentials) are stored in Cloudflare Secrets and never hardcoded in source code.
• Source code is hosted on GitHub with branch protection rules enforced; no direct commits to the main/production branch.

3.3 Principle of Least Privilege

• Developer access to production systems is scoped to the minimum necessary for each role.
• Cloudflare Worker service accounts use scoped API tokens with only required permissions.
• Third-party integrations (e.g., Alpaca OAuth) receive only the OAuth scopes explicitly required for functionality.

4. Encryption of Data at Rest and in Transit

4.1 Data in Transit

• All data transmitted between users and the platform is encrypted via TLS 1.2 or TLS 1.3, enforced at the Cloudflare edge. HTTP connections are automatically redirected to HTTPS.
• API calls to broker partners (e.g., Alpaca) are made exclusively over HTTPS using certificate validation.
• WebSocket connections for real-time data are secured via WSS (WebSocket Secure).

4.2 Data at Rest

• Sensitive data fields (OAuth tokens, API credentials) are encrypted using AES-256 before storage in Cloudflare KV, D1, or R2.
• Cloudflare’s infrastructure provides underlying encryption at rest for all stored data across its global network.
• Encryption keys are managed through Cloudflare’s key management infrastructure and rotated annually or upon suspected compromise.

5. Vulnerability Management and Patch Management

5.1 Dependency Management

• All third-party npm and software dependencies are tracked and reviewed using automated tooling (GitHub Dependabot or equivalent).
• Critical and high-severity CVEs in dependencies are patched within 7 days of disclosure; medium-severity within 30 days.
• Production deployments use pinned dependency versions to prevent supply-chain attacks via unexpected updates.

5.2 Infrastructure Security

• The platform has no traditional server attack surface — all compute runs on Cloudflare Workers (serverless edge functions), eliminating OS-level vulnerability exposure.
• Cloudflare’s WAF (Web Application Firewall) is enabled and provides OWASP Top 10 protection including SQL injection, XSS, and DDoS mitigation.
• Cloudflare Bot Management is enabled to detect and block automated threat actors.

5.3 Code Security

• All code changes undergo peer review before deployment to production.
• Static analysis tools are integrated into the CI/CD pipeline to detect common security vulnerabilities (injection, insecure deserialization, etc.).
• Secrets are scanned in CI/CD pipelines to prevent accidental credential exposure in code commits.

6. Incident Response and Disaster Recovery

6.1 Incident Classification

• Severity 1 (Critical): unauthorized access to user data, credential exposure, service-wide outage. Response time: immediate, within 1 hour.
• Severity 2 (High): single-user data exposure, partial service degradation, suspected breach. Response time: within 4 hours.
• Severity 3 (Medium): non-sensitive data exposure, performance degradation. Response time: within 24 hours.

6.2 Incident Response Procedure

• Contain: isolate affected systems, revoke compromised credentials, block malicious traffic at the Cloudflare WAF layer.
• Assess: determine scope, affected users, and data exposure.
• Notify: affected users are notified within 72 hours of confirmed breach, consistent with applicable data protection regulations.
• Remediate: root cause analysis completed; fix deployed and verified.
• Document: post-incident report produced within 14 days; lessons learned incorporated into controls.

6.3 Disaster Recovery

• The platform leverages Cloudflare’s globally distributed network, which provides built-in geographic redundancy with automatic failover across edge nodes.
• Database backups (Cloudflare D1 / Neon) are taken daily with 30-day retention.
• Recovery Time Objective (RTO): 4 hours. Recovery Point Objective (RPO): 24 hours.
• Disaster recovery procedures are tested at least annually.

7. Physical Security

Quantago operates as a fully cloud-native, remote-first company with no physical data center footprint. All compute and storage infrastructure is provided by Cloudflare Inc., which maintains SOC 2 Type II and ISO 27001 certified facilities.

Company-operated endpoints (developer workstations) are subject to the following controls:

• Full-disk encryption is required on all developer workstations (FileVault on macOS, BitLocker on Windows).
• Screen lock activates after 5 minutes of inactivity.
• All developer workstations run current, vendor-supported operating system versions with automatic security updates enabled.
• Browser-based password managers with strong unique passwords are used for all accounts; no password reuse is permitted.
• Work-related data is not stored on unencrypted removable media.

8. Vendor Risk Management

8.1 Critical Vendors

The Company maintains the following critical infrastructure vendors and their security postures:

8.2 Vendor Assessment

• New vendors processing user data or accessing production systems are assessed for security posture prior to onboarding.
• Critical vendors are reviewed annually for changes to their compliance certifications and security practices.
• Vendor access is scoped to the minimum necessary and revoked promptly upon contract termination.

9. Security Architecture Summary

Quantago’s security posture is inherently strong by virtue of its infrastructure choices. Key architectural properties:

• No traditional server infrastructure: eliminates entire classes of OS-level and network-level vulnerabilities.
• No custody of user funds: Quantago does not hold, transfer, or have discretionary access to user financial assets. Users connect their own broker accounts via OAuth and retain full control.
• Isolated execution: trading bots execute within Cloudflare’s sandboxed Worker runtime (V8 Isolates), preventing cross-tenant interference.
• No PII beyond account data: the platform does not collect Social Security numbers, payment card data, government IDs, or other high-sensitivity personal information.
• Zero-trust credential handling: broker OAuth tokens are treated as the highest sensitivity data class and stored with AES-256 encryption, never logged, never exposed in API responses.

10. Policy Review and Compliance

• This policy is reviewed and updated at minimum annually, or following any material change to the platform architecture, a security incident, or new regulatory requirements.
• All personnel with access to production systems are required to be familiar with this policy.
• Violations of this policy may result in revocation of system access.

---

Contact

For security inquiries or to report a vulnerability, contact security@quantago.co.

Quantago Cybersecurity Policy v1.0 | Effective April 29, 2026 | Operated by Universal Reason LLC