Security at VATIP Connect

LAST UPDATED · 07 JUL 2026

1. Account security

• Passwords hashed with a modern algorithm (Argon2id); we can never see them.
• Two-factor authentication available for all members; required for association staff.
• Rate-limited sign-in, session rotation, and active-session management in Settings.
• Every application is manually verified before any trade data unlocks.

2. Data protection

• All traffic encrypted in transit (TLS 1.2+). Backups encrypted at rest.
• Each website runs in an isolated tenant data store — no shared database with other sites.
• Card details are handled entirely by Stripe (PCI-DSS Level 1); we store none.

3. Members-only gating

Trade contacts, commissions and rate sheets are enforced on the server: locked data is never sent to the browser of a non-entitled visitor. Rate documents are served through short-lived signed links tied to your membership, not public URLs.

4. Infrastructure

Server-rendered platform written in Go, media on S3-compatible storage, edge routing and DDoS protection via Cloudflare. Admin interfaces are separated from the public site and protected with role-based access — membership staff cannot change system settings, editors cannot access billing.

5. Operations & backup

Nightly encrypted backups with 30 daily and 12 monthly restore points, and regular restore drills (not just backups). Security-relevant actions — approvals, tier changes, Strategic designations, exports — are written to an audit log.

6. Report a vulnerability

We welcome good-faith reports: [email protected]. Please avoid accessing other members' data while testing; we commit to acknowledge within 3 business days and not to pursue good-faith researchers.