This page is maintained by the Aurum PLC team to answer common questions about security and privacy. It describes controls currently active in the app — not an independent certification.
Account & Authentication
Sign-in via email/password and Google OAuth.
User sessions are managed with secure tokens; sign-out ends the session on the device.
Admin roles are granted manually by an operator — no automatic escalation.
Data Storage
Data is stored in a managed database with Row Level Security (RLS) enabled on sensitive tables.
Row access is limited to the owning user; admin access is gated through a separate role table.
Deposit proofs are stored in a private bucket and accessible only to the uploader and admins.
Encryption
Traffic between browser and server uses HTTPS/TLS.
Sensitive data is never exposed to anyone other than the account owner.
Keys & Secrets
Service keys and API secrets live only on the server, never in the browser.
External webhooks (e.g. the MT5 bridge) are validated with a secret before processing.
Subprocessors
Hosting & database: Lovable Cloud (powered by Supabase).
Aurum PLC is responsible for application configuration, access controls, and data protection on the server. You are responsible for keeping your password confidential, securing the email account you sign in with, and not sharing your credentials.