Security

TradesInvo runs on AWS in the London region (eu-west-2), with managed Postgres via Supabase and Cloudflare for CDN, WAF and DDoS protection.

• Multi-AZ deployment for high availability.
• Automated daily backups with 35-day retention.
• Disaster recovery RTO 4 hours, RPO 1 hour.

• In transit: TLS 1.2+ with modern cipher suites.
• At rest: AES-256 for database, object storage and backups.
• Secrets managed via AWS KMS with annual key rotation.

• Role-based access control (RBAC) for both customers and staff.
• Mandatory MFA for all staff with production access.
• Least-privilege access reviewed quarterly.
• SSO via Google Workspace for staff; SAML SSO available on Enterprise plans.

Centralised, tamper-evident audit logging across application, infrastructure and authentication events, retained for 12 months. 24/7 alerting on anomalous activity.

• Annual independent penetration test (CREST-certified).
• Continuous static analysis and dependency scanning in CI.
• Bug bounty channel: security@tradesinvo.com.

• Background checks for staff with production access.
• Security training at induction and annually.
• Confidentiality clauses in all employment contracts.

We maintain a documented incident response plan, on-call rotations and post-incident reviews. Customer notification within 48 hours of confirming a personal data breach.

• UK GDPR & Data Protection Act 2018.
• PCI DSS scope reduced via Stripe (we never store card data).
• ICO registration: ZB100000 (placeholder).
• Cyber Essentials certification: in progress.

Please email security@tradesinvo.com with details. We respond within 2 business days and aim to acknowledge valid reports within 5 business days.