Security at TradXM
Security practices we've built into the platform's architecture — not just a policy document.
Account Protection
- ✓Email verification on sign-up
- ✓Optional TOTP two-factor authentication with backup codes
- ✓Login history and active session management
- ✓New-device login notifications
- ✓Brute-force and rate-limit protection on authentication endpoints
Data Protection
- ✓Passwords hashed, never stored in plain text
- ✓Sensitive documents stored on a private disk, never publicly accessible
- ✓Every document access is logged with actor, timestamp, and purpose
- ✓Bank and payout details encrypted at rest
Financial Controls
- ✓Append-only wallet ledger — balances are never edited directly
- ✓Maker-checker approval on administrative balance adjustments
- ✓Two-person approval required for large withdrawals
- ✓Idempotent financial operations to prevent duplicate processing
Platform Integrity
- ✓Role-based access control with least-privilege permissions
- ✓Full audit trail on sensitive actions across the platform
- ✓CSRF, XSS, and SQL-injection protections throughout
- ✓Automated tests covering critical financial calculations
We do not publish unverified security certifications or compliance claims. Any regulatory status or
certification will be listed here only once formally obtained and verifiable.