Data Security & Protection Standards
Comprehensive technical and organizational security architecture implemented on TradeNov in adherence to Section 8(5) of the DPDP Act, 2023.
1. Cryptographic Encryption Standards
All databases, file attachments, analytical reports, and system backups are encrypted using military-grade Advanced Encryption Standard (AES) 256-bit keys managed through dedicated Key Management Systems.
All communications between web clients, mobile apps, and our microservices require TLS 1.3 encryption with Perfect Forward Secrecy (PFS), preventing eavesdropping or man-in-the-middle attacks.
2. Identity, Authentication & Password Safety
- Salted Cryptographic Hashing: Passwords are never stored in plaintext or reversible formats. We apply high-iteration Bcrypt cryptographic salting and hashing.
- Two-Factor OTP Verification: Critical actions, including account registrations, password resets, and bank withdrawal requests, require real-time 6-digit Time-based One-Time Passwords (OTP).
- Session Token Security: Authentication sessions utilize secure, HttpOnly, SameSite JSON Web Tokens (JWT) with automated expiration. Logging out instantly revokes all active device tokens.
- Role-Based Access Control (RBAC): Strict software boundary enforcement completely segregates Trader, Expert, and Super Admin privileges.
3. Network Architecture & DDoS Mitigation
- Web Application Firewall (WAF): Intelligent edge filtering blocks common exploit patterns, including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF).
- DDoS & Bot Defense: Enterprise edge routing absorbs volumetric Distributed Denial of Service attacks to ensure continuous uptime during high-volatility market events.
- VPC Network Isolation: Production databases operate in isolated private Virtual Private Clouds (VPC) with zero direct public internet routing.
4. Immutable Ledgers & Disaster Recovery
- Immutable Audit Trails: Trade tip publications, stop-loss edits, and wallet ledgers are immutably logged with precise nanosecond timestamps to prevent post-facto tampering.
- Point-in-Time Recovery (PITR): Automated continuous database backups allow instant state restoration in the event of hardware failure or physical data center anomalies.
- Geo-Redundant Storage: Encrypted backups are replicated across separated Tier-4 Indian data center zones in full compliance with Indian data sovereignty rules.
5. Incident Response & Statutory Breach Reporting
In compliance with Section 8(6) of the DPDP Act 2023 and CERT-In Cyber Security Directions (under Section 70B of the Information Technology Act):
- In the event of an identified personal data breach, TradeNov will promptly notify the Data Protection Board of India and all impacted Data Principals with technical mitigation guidance.
- Cybersecurity incidents are reported to CERT-In within mandated statutory reporting windows (within 6 hours of identification).
6. Responsible Vulnerability Disclosure & Grievance Desk
We welcome responsible disclosures from ethical security researchers. If you identify a security vulnerability or have a data safety inquiry, contact our security desk directly:
