Security & Data Protection

1. Identity and workspace boundaries

Customer Login uses email and password. Registration verifies access to the email address before creating an account. Passwords are stored using salted scrypt hashes, not readable passwords. Password reset requires email verification; a successful reset invalidates existing customer sessions.

Customer sessions use Secure, HttpOnly, SameSite cookies with an eight-hour lifetime. Account endpoints validate request origins and apply attempt limits. Customer APIs also enforce subscription status, license dates, subscribed emails, enabled features and permissions. Owner Admin Control requires the authorised owner identity. Demo visitors cannot write or reset shared records.

Stock and purchasing changes recheck permissions and linked records. Selected concurrent-write and rollback scenarios have automated checks. These checks are development evidence, not an independent security audit.

2. Records and uploads

The application uses a database for structured records and object storage for uploaded assets. File-handling routes check access and supported upload constraints. Spreadsheet imports validate required fields and references, and return row-specific errors. Users should still upload only necessary information from trusted sources.

3. Browser protections

Private screens and APIs use no-store cache rules. Response headers include content-type protection, frame restrictions and a report-only content-security policy. A report-only policy reports violations rather than blocking them. Screen-capture deterrents cannot prevent operating-system screenshots.

4. Security scope

This page describes implemented controls. It does not claim independent security certification, guaranteed uptime or a recovery-time commitment. Customers should restrict access, keep their devices secure and protect exported files.

The documented implementation is not a promise of perfect security. Provider infrastructure protections do not automatically certify the application or customer processes.

5. Report a concern

Email toppassiontrading@gmail.com with the affected page, time, business/workspace reference and a concise description. Do not include passwords, full identity documents or other customers’ records. Report suspected access issues promptly and stop the affected activity while the team investigates. Statutory notification obligations must be handled under the applicable incident process.