Security at SumoIQ
SumoIQ is designed never to hold or move your money, and to show you a mistake, ours or a strategy's, rather than miss it.
We never hold funds. SumoIQ connects to your brokerage account through your broker’s own authorization. SumoIQ is designed to accept trading-only access and to reject access that carries withdrawal permission.
Encrypted in transit. Traffic to our dashboard, API and sign-in services is encrypted with TLS on both legs, from your browser to Cloudflare and from Cloudflare to our servers. Plain HTTP is redirected to HTTPS, and certificates renew automatically. Our dashboard, API and sign-in services also tell browsers to connect to them only over HTTPS (HSTS, with a one-year duration).
Closed by default. Our server firewall denies all inbound traffic by default, and only web traffic is open to the public. Our databases, cache and secrets manager accept connections only from inside our servers and are not reachable from the internet.
Locked-down server access. Logging in to our servers requires a cryptographic key and is allowed only from an allowlist of addresses; password login is disabled. Repeated failed logins are blocked automatically (fail2ban), and the kernel’s mandatory access control (AppArmor) is on.
Patched automatically. Operating-system security updates install automatically; kernel updates take effect when the server is next restarted.
Secrets kept out of code. Secrets are held in a self-hosted secrets manager and kept out of source code. A secret scanner (Gitleaks) checks code changes in our commit and release process and blocks any change it flags.
Your data kept apart. Customer data is organised by tenant, and our main database applies row-level security rules that keep each tenant’s rows apart on core customer tables, such as subscriptions and exchange connections.
Sign-in required. Our dashboards and their data APIs require sign-in. Our sign-in service locks an account after repeated failed sign-in attempts.
A write-once audit archive. Records written to our compliance archive are stored under S3 Object Lock in compliance mode with a seven-year retention period, so our archive storage refuses any request to change or delete them before then.
Daily off-site backups. Databases and configuration are copied off our servers every day over encrypted connections, and automated drills regularly test a restore and check backup integrity.
Refuses when in doubt. If a risk check can’t be completed, SumoIQ is designed to refuse the order.
Measured continuously. Health, latency and error metrics are recorded continuously for our running services.
Responsible disclosure. Found a vulnerability? Email security@sumoiq.io. We aim to acknowledge reports within two business days.