Legal

Security & Incident Response Policy

In short

  • We protect accounts and data with encryption in transit, hashed passwords and tokens, restricted administrative access and daily backups.
  • If a security incident affects your data, we will tell you without undue delay and help you meet any obligations you have.
  • Please report suspected vulnerabilities to us privately.

This summary helps you find your way; the full text below is what applies.

1. Scope

This policy describes how TradeReach AI protects the Service and the information in it, and what we do if something goes wrong. It forms part of our Terms of Service. We do not currently hold any third-party security certification.

2. How we protect the Service

  • All connections to the website, dashboard and our webhooks use HTTPS (TLS).
  • Passwords are stored only as salted scrypt hashes. Login sessions use random tokens stored only as hashes, in cookies marked HttpOnly, Secure and SameSite.
  • Each business can see only its own data. Requests for another business's data are refused.
  • Administrative access requires a separately granted role and a recent login, and administrative actions are recorded.
  • Repeated failed logins and abusive request patterns are rate-limited.
  • Messages from our telecommunications and payment providers are accepted only with a valid cryptographic signature.
  • Secrets such as API keys are kept out of the source code and stored with restricted file permissions.
  • The database is not reachable from the internet. Customer personal information is removed from operational logs.
  • Daily database backups are integrity-checked, kept for a limited time and restricted to authorised access.

3. Your part

  • Use a strong, unique password and keep it private. Remove access for people who leave your business.
  • Keep the phone that forwards calls to TradeReach secure, and tell us if your number changes or is lost.
  • Tell us straight away at support@tradereach.net if you think your account has been accessed without permission.

4. If an incident happens

  • Contain: we act quickly to stop the incident and limit its effects, for example by revoking sessions, rotating keys or suspending affected features.
  • Assess: we work out what information was involved, whose it is and the likely harm. Where Australia's Notifiable Data Breaches scheme applies, we complete this assessment as quickly as possible and within the 30 days it allows.
  • Notify: if your account or your customers' information is affected, we tell you without undue delay, explain what happened and what we are doing, and give you the information you need to meet your own obligations. Where the law requires it, we notify the Office of the Australian Information Commissioner and affected individuals.
  • Review: after the incident we record what happened and make changes to prevent it happening again.

5. Reporting a vulnerability

If you believe you have found a security weakness, please email support@tradereach.net with enough detail for us to reproduce it, and give us a reasonable time to fix it before telling anyone else. Please do not access other people's data, disrupt the Service or send messages to real phone numbers while testing.