Security — RobotCopier

Encryption

Broker passwords at rest: AES-256-GCM with a 12-byte CSPRNG IV and a 16-byte auth tag per record. The master key lives in a SOPS-encrypted vault and is injected into the orchestrator and copy-engine containers as an env var at deploy time. Plaintext never touches disk on production nodes.
Account passwords: Argon2id (memory cost 19 MB, time cost 2, parallelism 1). OWASP baseline parameters.
In transit: TLS 1.2+ on every public endpoint, HSTS preload. Inter-node traffic on a WireGuard mesh.

Network & isolation

Public ports per node: :443 on the London primary (Cloudflare-fronted) and :22 + :51820/udp on every node, restricted to a fixed admin IP.
Default-deny firewall on every host; provider-edge firewall + host-level UFW.
SSH key-only auth, root login disabled by name.
No production service exposes mtapi, Postgres, Redis or NATS publicly.

Authentication

Short-lived JWT access tokens, 8 h. Cookies are HTTP-only, SameSite=Lax, Secure in production.
Optional two-factor authentication (TOTP) for clients who want an additional sign-in check — rolling out in v2.5.
Self-service password change + soft-delete from the dashboard.

Audit & observability

Every trade event journaled with risk verdict, latency, source/destination labels, owner — replicated from London primary to New York standby.
Structured JSON logs from every service to a centralised store. 90-day hot retention, 6-year cold.
Alerting on anomalous access patterns (cross-region cookie reuse, repeated failed logins from new IPs).

Disclosure & response

Found something? Email [email protected] with a description and reproduction steps. Our coordinated-disclosure window is 90 days from acknowledgement — we'll keep you posted at every step. We don't pay bounties yet but we'll publicly credit researchers who help us harden the platform.

Compliance

UK GDPR / Data Protection Act 2018 — controller registration with the ICO.
SOC 2 Type 1 audit in progress (target Q3).
PCI scope is zero — card data is handled exclusively by Stripe.