Information Security Policy

Purpose

This policy defines the security principles and practices that govern how myTraderDash protects user data, application infrastructure, and business operations.

Data Classification

Sensitive — Brokerage access tokens, OIDC client secrets, API keys. Encrypted in transit, stored in environment files excluded from version control, never logged.

Personal — User email, display name, trading history. Encrypted in transit, workspace-isolated, deletable on request.

Internal — Application configuration, deployment settings. Access restricted to administrator.

Public — Marketing site content, documentation. No restrictions.

Access Control

All user authentication is handled via OpenID Connect with Google, Apple, and Yahoo. No passwords are stored. All administrative systems require multi-factor authentication. Single administrator with direct access to infrastructure. All user data is scoped to a workspace, enforced in application middleware and at the database level with row-level security.

Infrastructure

Production runs on a dedicated server hosted by DigitalOcean in Toronto, Canada. The server publishes no application ports to the internet: all traffic arrives through an authenticated, encrypted Cloudflare Tunnel. SSH access uses key authentication only. The database and cache are reachable only on a private network internal to the server. Production runs prebuilt, version-pinned container images; no source code is stored on the server.

Encryption

In Transit — Browser connections use TLS 1.2 or higher and HTTPS is enforced on all endpoints. Traffic between Cloudflare and the origin server travels through an encrypted tunnel.

At Rest — Secrets are stored only in access-restricted environment files on the server, never in source control.

Vulnerability Management

Automated dependency scanning and updates via GitHub Dependabot.

npm security audit via GitHub Actions on every push and pull request.

Every change runs type checking, unit and integration tests, and end-to-end tests before it can be deployed, and production deploys are a separate, deliberate step.

Application Security

Input validation on API endpoints.

CORS origin allowlist.

Rate limiting on authentication endpoints, keyed on the client address supplied by Cloudflare.

Session security with HttpOnly, Secure, SameSite cookies and a Redis-backed session store; sessions are revoked on logout and account deletion.

PKCE on all OIDC flows.

Body size limits to prevent oversized request attacks.

Incident Response

1. Contain — Isolate affected systems, revoke compromised credentials.

2. Assess — Determine scope and whether there is a risk of serious harm.

3. Notify — Inform affected users within 72 hours, and notify the relevant privacy regulator (Office of the Privacy Commissioner of Canada, Quebec's Commission d'accès à l'information) where required.

4. Remediate — Fix vulnerability, rotate credentials.

5. Review — Document the incident and update practices.

Third-Party Services

DigitalOcean — Hosting (Toronto).

Cloudflare — Network security, DNS, tunnel.

Google, Apple, Yahoo — OIDC sign-in (OAuth 2.0 + PKCE).

Google Gmail and Firebase — Email and push notification delivery.

SnapTrade, Plaid — Brokerage connections (tokenized access, TLS).

Stripe — Payments (PCI-DSS compliant, no card data stored).

Policy Review

Reviewed when significant infrastructure changes occur, new integrations are added, after security incidents, or at minimum annually.

Contact

General — admin@mytraderdash.com

Support — support@mytraderdash.com

Privacy — privacy@mytraderdash.com

Security — security@mytraderdash.com