Security at wallmarkets
We protect your data with enterprise-grade security practices, encryption, and continuous monitoring.
Security Overview
Every layer of our platform is designed with security at its core.
Encryption
All data encrypted in transit (TLS 1.3) and at rest (AES-256). Database encryption keys managed separately from data. HTTPS enforced on all connections.
Access Control
Role-based access with five permission levels. Two-factor authentication available for all users. Session management with forced sign-out capability.
Monitoring
24/7 infrastructure monitoring. Real-time intrusion detection. Automated alerts for suspicious activity. Immutable audit logs for every account action.
Compliance
GDPR compliant. SOC 2 Type II on our roadmap. Data Processing Agreements available. Regular third-party security audits and assessments.
Infrastructure Security
- Hosted on enterprise-grade cloud infrastructure
- Network segmentation and firewalls
- Regular security patches and updates
- DDoS protection
- Automated backups with encryption
Application Security
- Input validation and output encoding (OWASP Top 10 protection)
- CSRF protection on all forms
- SQL injection prevention (parameterized queries)
- Rate limiting on all API endpoints
- Content Security Policy headers
- Secure session management with HttpOnly, Secure, SameSite cookies
Authentication & Authorization
- Passwords hashed with bcrypt (industry standard)
- Two-factor authentication (TOTP)
- API keys hashed with SHA-256
- Scoped API permissions
- Automatic session expiry
- IP-based access restrictions (Enterprise)
- OAuth 2.0 (Google) sign-in
Data Protection
- TLS 1.3 for all connections (HTTP redirected to HTTPS)
- AES-256 encryption at rest
- Database encryption key rotation
- Secure file upload handling
- Data isolation between accounts (multi-tenant with strict boundaries)
- PII handling compliant with GDPR
Operational Security
- Principle of least privilege for internal access
- Code review required for all changes
- Dependency vulnerability scanning
- Regular penetration testing
- Incident response plan documented and tested
- Security-focused development lifecycle
Compliance & Certifications
We maintain compliance with industry standards and pursue recognized certifications to ensure your data is handled responsibly.
Full compliance with EU General Data Protection Regulation
SOC 2 Type II certification on our roadmap
Data Processing Agreements available for enterprise customers
Regular third-party security audits and assessments
Security Best Practices for Users
Follow these recommendations to keep your account and data secure.
Create a strong, unique password for your wallmarkets account. We recommend using a password manager such as 1Password, Bitwarden, or KeePass to generate and store complex passwords securely.
Consider using a passphrase approach: combine four or more unrelated words (e.g., "correct-horse-battery-staple") for a password that is both strong and memorable.
Never reuse passwords across different services. If one service is compromised, reused passwords put all your accounts at risk.
Two-factor authentication (2FA) adds a critical second layer of security to your account. Even if your password is compromised, an attacker cannot access your account without the second factor.
We support time-based one-time passwords (TOTP) via authenticator apps such as Google Authenticator, Authy, or Microsoft Authenticator.
Treat API keys with the same care as passwords. They grant programmatic access to your account and data.
- Rotate API keys every 90 days
- Never commit API keys to source control or include them in client-side code
- Use environment variables or a secrets manager to store keys
- Apply the minimum required scopes to each key
- Revoke keys immediately when they are no longer needed
Periodically review your active sessions and audit log to ensure no unauthorized access has occurred. End any sessions you do not recognize.
If you notice any unusual activity on your account -- unexpected logins, data changes you did not make, or unfamiliar API key usage -- report it immediately by contacting our security team.
Time is critical when responding to security incidents. The sooner we are notified, the faster we can help protect your account.
Vulnerability Disclosure Program
We take security reports seriously and appreciate the work of researchers who help us keep wallmarkets safe.
What to Report
- A clear description of the vulnerability
- Steps to reproduce the issue
- Potential impact and severity assessment
- Any supporting screenshots or proof-of-concept code
Our Response Timeline
- Acknowledgement within 24 hours
- Initial triage and severity assessment within 72 hours
- Regular updates as we investigate and resolve the issue
- Recognition for valid, responsibly disclosed reports
Responsible Disclosure
We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it. We commit to working with you transparently throughout the process and providing credit for valid reports if desired.
A PGP key for encrypted reports will be published with our public release.
Incident Response
If you suspect your account has been compromised, take these steps immediately.
Change Your Password
Update your password immediately to a new, strong password.
Enable 2FA
If not already enabled, set up two-factor authentication.
End All Sessions
Sign out of all active sessions from your security settings.
Review Audit Log
Check your audit log for any unauthorized actions.
Revoke API Keys
Rotate or revoke any API keys that may have been exposed.
Contact Support
Reach out to our team so we can assist with your account.