Security, privacy and assurance for Fit2Trade.
For organisations assessing Fit2Trade, this page summarises current controls across access, data, application security, infrastructure and internal security. More detailed procurement documentation is available through our client assurance pack.
Permissions are managed through role-based access controls, with internal access based on least privilege.
Customer data is encrypted at rest and in transit, with regular backups in place.
Network, penetration-testing, policy and procurement information can be provided during assurance review.
Product security
- Role-Based Access Control
- Fit2Trade implements role-based access control to manage permissions.
- Multi-Factor Authentication
- MFA can be enabled for user accounts through an SSO provider.
- Integrations
- Fit2Trade can integrate with providers via API, with API keys stored in an encrypted database.
Data security
- Encryption at rest
- Customer data is encrypted at rest using AES-256.
- Encryption in transit
- Customer data is encrypted in transit using TLS 1.2.
- Backups
- Backups are conducted regularly to support recovery in the event of data loss.
- Data deletion
- Data deletion is available on request in line with applicable GDPR requirements.
Application security
- Credential management
- User credentials are salted, hashed and stored by Auth0. Infrastructure secrets are managed through a secure key vault.
- Secure development
- The Secure Development Policy includes peer review, automated testing and static code analysis before production deployment.
- Code analysis
- Tools are used to identify issues in code and third-party dependencies.
- Vulnerability management
- A formal vulnerability-management process is used, with patches applied against a documented SLA.
Privacy and access
- Least-privilege access
- Access to internal systems is granted on the principle of least privilege and reviewed regularly.
- Security logging
- Important security events in the environment are monitored.
- Account information
- The platform requires an email address and name for account registration.
- Privacy and security training
- Personnel complete security and privacy awareness training annually.
Infrastructure and resilience
- Microsoft Azure
- Fit2Trade infrastructure is primarily hosted in Microsoft Azure across multiple regions in the United States, Europe and the UK.
- Business continuity and disaster recovery
- A formal BC/DR plan is exercised, reviewed and approved annually.
- Separate production environment
- Customer data is not used in non-production environments.
- Infrastructure as code
- Infrastructure-as-code techniques are used to deploy infrastructure resources.
Corporate and endpoint security
- Endpoint protection
- Employee endpoints use full-disk encryption, DNS filtering, endpoint detection and response, and central device management.
- Internal authentication
- Single Sign-On is used internally, with MFA required for internal accounts that do not support SSO.
- Incident response
- A documented Incident Response Plan is reviewed, tested and approved at least annually.
- Internal assessment
- An annual risk assessment is used to identify major security gaps in the environment.
Assurance, reports and policies
For customer procurement and security reviews, Fit2Trade can provide a current client assurance pack and respond to specific control questions.
- High-level network diagram
- Penetration-test report
- Data Processing Agreement
- Master Services Agreement
- Relevant security policies
- Annual third-party penetration testing
- Cyber insurance coverage
- Subprocessor information
- Incident-response planning
- Annual internal risk assessment
Security policy areas
Policy areas include acceptable use, access control, anti-virus and malware, clean desk, code of conduct, cybersecurity, data management, email and instant messaging, encryption standards, incident response and management, information security, network perimeter security, operations security, physical security, risk management, secure development, technology and media destruction, third-party management and vulnerability management.