Security & Privacy

You have full control over your personal data. Every right listed below is implemented and accessible directly from your profile, under "Your Data & Privacy".

• •Access and download your personal data as a structured JSON export at any time
• •Update your data directly from your profile; changes to critical fields (company name, VAT) go through a verification process
• •Delete your account permanently: all PII is anonymized, uploaded documents are removed from storage, and all tokens are invalidated
• •Export your profile, company info, consent history, document metadata, login history, and notification preferences
• •Opt out of marketing and WhatsApp communications independently, with instant effect

All personally identifiable information is encrypted at rest using AES-256. This includes your email, IBAN, phone number, tax ID, and WhatsApp number. Cleartext columns have been removed from the database entirely. Encryption keys are managed through secure environment variables, and the system prevents startup in production without properly configured keys.

• •AES-256 encryption at rest for all PII
• •HTTPS enforced with HSTS (1 year, including subdomains)
• •Passwords hashed with Argon2 (industry-standard winner of the Password Hashing Competition)
• •Session tokens expire in 15 minutes; refresh tokens rotate automatically and invalidate predecessors
• •Application logs never contain personal data: emails, phone numbers, tax IDs, and tokens are excluded

Every resource on the platform is inaccessible unless explicitly authorized. Our role-based access control (RBAC) system follows a deny-by-default policy.

• •Strict role-based permissions: buyers, vendors, insurers, and admins each access only their own resources
• •Rate limiting on login, magic links, and contact forms (e.g., 3 magic links per hour, 5 per day)
• •Anti-enumeration: login and reset responses are identical regardless of whether the email exists
• •reCAPTCHA v3 protection mandatory in production
• •CSRF protection via security headers and origin validation

We keep your data only as long as necessary. Automated retention policies run on strict schedules, and inactive users receive a 30-day warning email before anonymization.

• •Audit logs: 365 days
• •Notification and WhatsApp delivery logs: 90 days
• •Inactive accounts (no login for 2 years): anonymized after 30-day notice
• •Orders and payments: 10 years (statutory financial record-keeping)
• •Soft-deleted records: permanently removed after 90 days

Consent is granular, explicit, and revocable. We never bundle consent or pre-check boxes. Each consent has its own timestamp and can be withdrawn independently with immediate effect.

• •Privacy consent required at registration via unchecked checkbox, with link to the full privacy policy
• •Marketing consent is separate, opt-in only, and revocable at any time from your profile
• •WhatsApp consent is dedicated and separate; revoke by sending "STOP" via WhatsApp or toggling your profile settings
• •Cookie banner compliant with UK GDPR and ICO guidance; no tracking before consent

Every operation involving personal data is logged. We maintain immutable records of deletions, consent changes, and data cleanup operations for full accountability.

• •Comprehensive audit trail for all operations on personal data, retained for 365 days
• •Immutable deletion registry: hashed email, original role, anonymized fields, document count (no cleartext PII)
• •Data cleanup operations logged with executor, categories, counts, and timestamps
• •No automated decision-making: our AI Advisor provides suggestions only, with explicit disclaimers and no binding effect on transactions

The platform has been reviewed against the OWASP Top 10 web application risk categories. Each control below maps to a specific risk class.

• •A01 Broken Access Control: every endpoint requires an explicit role-and-permission match; access defaults to denied; resource ownership is verified before any sensitive operation
• •A02 Cryptographic Failures: personal data encrypted at rest; HTTPS enforced on all traffic with a long-lived HTTPS-only browser policy; passwords never stored in plain or reversible form
• •A03 Injection: all database queries use parameter binding, never string concatenation; every inbound request is validated at the API boundary before reaching business logic
• •A04 Insecure Design: business-critical flows (orders, payments, commission) follow strict state transitions; duplicate-submit protection on write endpoints; counterparty identity is hidden until the commission is settled
• •A05 Security Misconfiguration: hardened response headers mitigate clickjacking, cross-site scripting, and mixed-content risks; internal error details are never exposed to clients
• •A06 Vulnerable and Outdated Components: dependency advisories reviewed against a curated policy before each release; accepted risks are documented with rationale; deprecated components are tracked in a public debt register
• •A07 Identification and Authentication Failures: short-lived session tokens with automatic rotation; invalidation on logout, role change, or abuse; brute-force rate limiting on authentication endpoints; password strength enforced server-side
• •A08 Software and Data Integrity Failures: dependency manifests pinned to exact versions to prevent supply-chain drift; immutable audit trail for personal-data operations; deletion registry retained after anonymization
• •A09 Security Logging and Monitoring Failures: structured logs for every privileged action; personal data never written to logs; audit logs retained 365 days for accountability
• •A10 Server-Side Request Forgery: the server never fetches user-supplied URLs; outbound traffic targets a fixed set of known integrations (payment, email, maps, market data providers)