Security overview
How we protect sign-in, access, transport and data on the platform.
This page describes the platform's protective measures without disclosing details that would help an attacker.
Sign-in
- Identity service. Sign-in runs through Auth0 with a tenant in the EU. Passwords are stored only there and never in our own database.
- Two factors on every sign-in. Two-factor sign-in is mandatory for every account, and there is no option for a device to remember the second factor. A passkey counts as a two-factor sign-in.
- Fresh sign-in for critical steps. Anyone who wants to delete their account first signs in afresh with the second factor and then confirms through a link sent by email.
- Checked on every request. On every request the server verifies the signature of the sign-in and whether the account still exists and is active.
- Sessions in view. Under Settings → Profil → Geräte (devices) you see your sessions and end them one by one or all others at once.
Access
- Rights are checked on the server. The interface hides what you may not do. What counts, though, is the check on the server that every request passes, even if someone bypasses the interface.
- Other people's data stays separate. Your own strategies, portfolios and Journal data are bound to your account, team data to your membership of the team.
- Request limits. Repeated requests in a short time are limited. For sign-in and other sensitive paths this also applies when the counting service is down.
- Protection against foreign requests. Requests that change state must come from our own site. The server refuses requests from other sites.
- Administration area. The area for administering the platform sits behind an additional access gate from Cloudflare.
Transport and browser
- HTTPS everywhere, with HSTS for all subdomains.
- Content Security Policy with a nonce per request and
strict-dynamic. Modern browsers then only run scripts we approve ourselves. - Isolation through Cross-Origin-Opener-, Cross-Origin-Resource- and Cross-Origin-Embedder-Policy, plus protection against being embedded in other sites.
Data
- Location. The database is in Frankfurt, uploaded files are stored at Cloudflare R2.
- Encryption. Data is encrypted in transit and at rest. Credentials and keys that the platform keeps for you are additionally encrypted with AES-256.
- Uploads are checked by their content and not just by their file extension.
- Free text is cleaned on save. Form input is stripped of HTML on the server before it is stored.
- Payments run through Stripe. GMJD stores no card data.
Logs
Security-relevant events, such as sign-ins, plan changes and account deletion, are logged. The logs are deleted after at most 90 days. Which data we store for how long is set out in the privacy policy.
Blocked countries
We block access from North Korea, Iran, Syria, Cuba, Belarus and Myanmar. We determine the country from the connection through Cloudflare.
Incidents
If a breach of personal data occurs, we report it to the competent supervisory authority under Art. 33 GDPR and inform those affected under Art. 34 GDPR.
Found a vulnerability?
Read Reporting security issues and write to security@gmjd-consulting.com.