Cybersecurity Policy

At Signal Synk, a subsidiary of Forefront Solutions Inc., protecting the integrity of our execution infrastructure and the confidentiality of our users' data is our highest priority. This Cybersecurity Policy outlines the administrative, technical, and physical safeguards we employ to mitigate risk and ensure a secure automated trading environment.

1. Non-Custodial Architecture & Attack Surface Minimization

By design, our infrastructure eliminates the risk of direct financial theft from our servers. Our system connects to your external brokerage accounts using modern OAuth 2.0 protocols or tightly scoped API keys. These connections are strictly limited to "Read" and "Trade Execution" permissions.

2. Data Encryption Standards

We deploy robust, military-grade cryptographic protocols to ensure that all sensitive data remains secure, both in transit and at rest.

• In Transit: All communications between your browser, our servers, and third-party brokerage APIs are encrypted using Transport Layer Security (TLS) 1.3 or higher.
• At Rest: All sensitive databases, including stored API credentials, session tokens, and personal identification information, are encrypted using the AES-256 standard.
• Key Management: API keys are tokenized and hashed. Our internal systems cannot reverse-engineer or display your raw API keys once they have been securely submitted.

3. Network & Infrastructure Security

Our routing engines and web applications are hosted in world-class, enterprise cloud environments engineered for maximum resilience against external threats.

• DDoS Mitigation: We utilize advanced Web Application Firewalls (WAF) and distributed denial-of-service (DDoS) protection to ensure high availability and prevent malicious traffic from disrupting trade execution.
• Rate Limiting & Throttling: Strict API rate limiting is enforced on all endpoints to prevent brute-force attacks and abuse.
• Isolated Environments: Our production execution environments are strictly isolated from our development and staging servers, minimizing the risk of cross-environment contamination.

4. Access Control & Zero-Trust Policy

Signal Synk adheres to the principle of least privilege (PoLP) and a Zero-Trust internal security framework.

• Internal Access: Employee access to production environments requires strict Multi-Factor Authentication (MFA), VPN routing, and hardware security keys. Access is granted solely on a temporary, as-needed basis.
• User Authentication: We highly encourage all users to enable Multi-Factor Authentication (MFA) on their Signal Synk accounts and their respective brokerage accounts to prevent unauthorized access.

5. Continuous Monitoring & Vulnerability Management

Our security posture is proactive, not reactive. We continuously monitor our infrastructure for anomalies and vulnerabilities.

• 24/7 Threat Detection: Automated intrusion detection systems (IDS) monitor network traffic and server behavior round-the-clock.
• Penetration Testing: We conduct routine third-party penetration testing and automated vulnerability scanning to identify and patch potential exploits before they can be leveraged.
• Log Auditing: Comprehensive access logs are maintained and routinely audited to trace any unauthorized modifications or suspicious access patterns.

6. Incident Response & Breach Notification

While no system can guarantee absolute security, we maintain a rapid-response protocol to isolate and neutralize potential threats.

In accordance with the FTC Safeguards Rule and state-specific data protection laws (including Nevada NRS 603A), if a data breach occurs that compromises your personal information or API integrity, we will notify affected users without undue delay, detailing the nature of the breach and the immediate steps taken to secure the platform.

7. Shared Responsibility

Cybersecurity is a shared effort. We implore our users to adhere to best practices:

• Utilize strong, unique passwords for your Signal Synk and brokerage accounts.
• Never share your login credentials, OAuth links, or raw API keys with third parties.
• Ensure the devices you use to access the platform are free of malware and securely updated.

8. Reporting Security Vulnerabilities

If you believe you have discovered a security vulnerability within the Signal Synk platform, we ask that you responsibly disclose it to our team immediately. Please contact our security operations center at [email protected].