Security Architecture

This page describes the actual security measures implemented in Tradepunch. No marketing buzzwords — just facts about how your account and data are protected.

Transparency Note

The security measures described below are the ones actually implemented in the Tradepunch platform. We do not claim any certifications, regulatory approvals, or third-party audits unless explicitly stated. Security is an ongoing process, and we continuously work to improve our protections.

Password Security — Argon2id

Passwords are hashed using Argon2id, the winner of the Password Hashing Competition. This memory-hard algorithm is resistant to GPU and ASIC brute-force attacks. We never store plaintext passwords.

Implementation Details

  • Argon2id key derivation function
  • Memory-hard to resist GPU attacks
  • Individual salt per password
  • Passwords never stored in plaintext

Session Management — SHA-256 Tokens

Sessions use cryptographically random tokens, hashed with SHA-256 before storage. Only the token hash is stored server-side — the raw token exists only in the client's HTTP-only cookie.

Implementation Details

  • Cryptographically random session tokens
  • SHA-256 hash stored server-side
  • HTTP-only, secure, SameSite cookies
  • Automatic session expiration

CSRF Protection — HMAC Tokens

State-changing requests are protected with HMAC-signed CSRF tokens. Token verification uses timing-safe comparison to prevent timing attacks.

Implementation Details

  • HMAC-signed CSRF tokens
  • Timing-safe token comparison
  • SameSite cookie policy
  • Origin/Referer validation

Role-Based Access Control (RBAC)

Granular permission system with Role → RolePermission → Permission architecture. Permissions use dotted keys (e.g., "withdrawal.approve") for precise access control.

Implementation Details

  • Granular dotted-key permissions
  • Role-to-permission mapping
  • Middleware enforcement
  • Principle of least privilege

Audit Trail — Append-Only Ledger

Every financial transaction is recorded in an append-only ledger with gapless sequence numbers and idempotency keys. Balances are reconstructible from the full transaction history.

Implementation Details

  • Append-only transaction ledger
  • Gapless sequence numbering
  • Idempotency key enforcement
  • Full history reconstruction

Infrastructure Security

Structured logging with automatic secret redaction (Pino). Environment validation via Zod schemas. All monetary calculations use decimal-precise arithmetic (never IEEE-754 floats).

Implementation Details

  • Secret redaction in logs
  • Environment schema validation
  • Decimal-precise arithmetic
  • Input validation with Zod

What We Don't Claim

Honesty about what we are and aren't is part of security.

  • We do not claim to be "bank-grade" or "military-grade" — these terms are marketing, not security standards.
  • We do not claim SOC 2, ISO 27001, or other certifications unless we hold them.
  • We do not claim to be "unhackable" — no system is. We claim to follow security best practices.
  • We do not claim regulatory oversight unless we are actually regulated.

Questions About Security?

If you have security questions or want to report a vulnerability, reach out to our team.

Contact Security Team