Administrative Access and Multi-Factor Authentication

Overview

myTraderDash is operated by a single administrator. All systems that store or process user data, source code, or infrastructure configuration require multi-factor authentication for access.

Systems with MFA Enabled

GitHub — Source code repository and container registry (TOTP / Passkey).

Gmail — Administrative email (TOTP / Passkey).

Cloudflare — DNS management, CDN, tunnel (TOTP).

NameCheap — Domain registration (TOTP).

DigitalOcean — Production hosting (TOTP).

Additional Provider Accounts

MFA is enabled on every financial data and payment provider account (such as SnapTrade, Plaid, and Stripe) before that provider is used in production.

Access Control Principles

No shared credentials.

SSH key authentication only (password-based SSH disabled).

Principle of least privilege for API keys, including a scoped, single-repository token for automation.

Database accessible only within the server's private network.

Production servers hold no source code and no repository credentials.

Credential Management

All secrets stored in environment files excluded from version control.

API keys are service-specific and independently revocable.

GitHub access limited to administrator account with MFA.

Incident Response

In the event of suspected credential compromise:

1. Revoke affected credentials immediately.

2. Rotate all related API keys.

3. Review access logs.

4. Notify affected users if data was potentially exposed.

Contact

General — admin@mytraderdash.com

Support — support@mytraderdash.com

Privacy — privacy@mytraderdash.com

Security — security@mytraderdash.com