Cybersecurity Policy

1. Purpose

This Cybersecurity Policy outlines the security controls, governance framework, and procedures implemented by QuantML Limited ("QuantML") to protect systems, infrastructure, user data, and third-party integrations from unauthorized access, misuse, disruption, or compromise.

QuantML is committed to maintaining the confidentiality, integrity, and availability of its systems and data.

2. Scope

This Policy applies to:

• Production infrastructure
• Cloud-hosted services
• Application code and APIs
• Corporate devices
• Employees and contractors with system access
• Third-party service integrations

3. Security Governance & Oversight

Security oversight is the responsibility of QuantML leadership. QuantML:

• Conducts periodic internal security reviews
• Assesses emerging risks related to platform infrastructure
• Reviews access privileges on a regular basis
• Maintains security documentation and incident logs

4. Infrastructure Security

4.1 Cloud Hosting

QuantML utilizes reputable cloud infrastructure providers with built-in security controls including:

• Encrypted HTTPS communication (TLS 1.2+)
• Managed server environments
• Firewalls and network isolation
• Secure environment variable storage
• Automatic security patching

Production infrastructure is logically separated from development environments.

5. Data Protection

5.1 Encryption

• All data in transit is encrypted using TLS.
• Sensitive API credentials and tokens are stored as AES-GCM encrypted environment variables.
• No secrets are hard-coded in source code.

5.2 Data Minimization

QuantML collects only necessary data required to operate the platform and does not store brokerage login credentials.

5.3 Brokerage Integration Security

Brokerage access tokens are encrypted at rest using AES-GCM with a per-user IV. Tokens are never exposed to the frontend and are only decrypted server-side in isolated backend functions.

6. Authentication & Access Control

• Role-based access control (RBAC) is implemented across the platform.
• Administrative privileges are limited to authorized personnel only.
• All production access requires authenticated credentials.
• Strong password standards are enforced.
• Single-use time-limited activation tokens are used for account onboarding.
• Access is revoked immediately upon termination of engagement.

7. API & Third-Party Integration Security

QuantML integrates with third-party services including brokerage APIs and payment processors using secure OAuth or token-based authentication.

• API keys are encrypted at rest.
• Tokens are never exposed to the frontend unnecessarily.
• All third-party integrations use HTTPS-only endpoints.
• Webhook endpoints are protected by shared secret validation.

8. Endpoint Protection

All corporate devices used to access production systems:

• Run up-to-date operating systems
• Utilize antivirus/anti-malware protection
• Enforce password protection and device lock policies

9. Monitoring & Logging

• Application events and errors are logged for audit and debugging.
• Suspicious activity is monitored.
• Rate limiting is implemented on sensitive endpoints.
• Token-based activation and authentication flows are single-use and time-limited.

10. Secure Development Practices

• Code changes are reviewed before deployment.
• Secrets are never committed to version control.
• Production changes are deployed in controlled environments.
• Activation tokens and authentication flows are hashed and time-bound.

11. Incident Response

In the event of a suspected security incident, QuantML will:

• Investigate the scope and impact promptly.
• Contain and remediate the issue.
• Notify affected parties where required by law (e.g. GDPR 72-hour notification requirement).
• Implement corrective measures to prevent recurrence.
• Document the incident and response for internal review.

12. Business Continuity

QuantML leverages cloud-based infrastructure with built-in redundancy and high availability to minimize service disruption. Critical data is backed up regularly.

13. Policy Review

This policy is reviewed at least annually and updated as necessary to reflect operational changes and emerging security risks.

14. Contact

For security-related enquiries or to report a vulnerability, please contact: quantml@quantml.ai