Security and access
Every rule in Trading Core is enforced in the database. The same checks apply whichever screen or interface is used, and nothing posted is ever updated or deleted.
Identity and sign-in
Section titled “Identity and sign-in”- Separate sign-in for customers and staff.
- Multi-factor authentication (an authenticator app) is required for all staff.
- Single sign-on with the back-office system is a deployment option.
- Staff roles include dealer, wallet, settlement, risk, finance and compliance.
- A configurable function-to-role matrix sets who may propose, approve or run each action.
- Each officer holds one role.
Four-eyes approval
Section titled “Four-eyes approval”- Applies to trade reversals, adjustments, large hedges, hot / cold sweeps, review releases, Travel Rule clearances and alert closures.
- The approver is named and must use a different login from the proposer.
- Approval roles are configurable per action.
| Action | Where it is described |
|---|---|
| Trade reversal | OTC desk and hedging |
| Large hedge | OTC desk and hedging |
| Hot / cold sweep | Wallets and custody |
| Review release, return or re-screen of a held deposit | Wallets and custody |
| Alert closure | Wallets and custody |
| Travel Rule gate clearance | Compliance controls |
Data isolation
Section titled “Data isolation”- Customers see only their own records.
- Applications have no direct table access. Every read and write goes through controlled functions that check the caller’s identity and role.
- Rules are enforced in the database. The same checks apply whichever screen or interface is used.
Integrity
Section titled “Integrity”- Append-only records, with no update or delete on posted data.
- Hashed keys for system-to-system links.
- Secrets kept in an encrypted vault, never in application code.
- Before-and-after backups for every change to system logic.
What the system does or refuses
Section titled “What the system does or refuses”- Refuses a staff sign-in without the authenticator code.
- Refuses an approval from the proposer’s own login, or from a role not allowed to approve that action.
- Refuses any direct table access by an application.
- Shows a customer only their own records.
- Refuses any update or delete of posted data.
Related
Section titled “Related”- Deployment and licensing — the client’s own instance and data
- Capital and regulatory reporting — the audit trail