Security and Compliance

Our Security Philosophy

Determinism and Auditability First. Aureum Sentinel is built on the principle that every calculation, risk estimate, and analytical output must be reproducible, verifiable, and auditable. This is non-negotiable for institutional risk management.

Unlike black-box analytics systems, Aureum Sentinel ensures:

• Deterministic Outputs: Given identical inputs and model versions, calculations always produce identical results. No floating-point approximations or random state bleed compromise reproducibility.
• Full Auditability: Every computation is traceable, from input data through intermediate calculations to final output. Audit logs prove exactly what was calculated, when, and by whom.
• Model Governance: Algorithm versions are frozen, versioned, and documented. Model changes are explicitly tracked and never applied retroactively to historical analyses.
• Access Transparency: Who accessed which data, when, and for what purpose is recorded immutably. This is critical for regulatory compliance and internal governance.

This architecture protects you from the greatest risk in quantitative finance: uncontrolled, unexplainable changes in analytical systems.

Infrastructure and Isolation

Deployment Architecture

Default: Multi-Tenant SaaS

Aureum Sentinel runs as a highly isolated multi-tenant system on AWS EKS (Kubernetes). Key features:

• Kubernetes network policies enforce isolation between tenants at the OS level
• Each tenant's data is logically isolated in PostgreSQL with row-level security (RLS)
• Redis session storage is segmented by tenant ID
• API routing automatically restricts users to their own data; cross-tenant access is cryptographically impossible

Optional: On-Premise or Isolated VPC Deployment

For regulated entities (pension funds, insurance companies) or those requiring strict data residency:

• We can deploy a single-tenant instance within your VPC or on-premise infrastructure
• You control all infrastructure, database, and backup policies
• We provide maintenance and updates via secure, audited channels
• Complete administrative control remains with your organization

Custom deployment arrangements are available upon request. Contact support@aureumfrontiers.com to discuss your infrastructure requirements.

Database Security

• Encryption at Rest: PostgreSQL data encrypted with AES-256 (AWS EBS encryption or on-premise full-disk encryption)
• Encryption in Transit: All database connections require TLS 1.3; unencrypted connections are rejected
• Parameterized Queries: All SQL queries use parameterized statements (prepared statements) to eliminate SQL injection risk entirely
• Access Control: Database users have minimal required privileges; application credentials are rotated regularly
• Audit Logging: All modifications to critical tables (users, roles, data access events) are logged to immutable audit tables
• Backup Encryption: Database backups are encrypted and stored redundantly in AWS S3 with cross-region replication

Network Security

• TLS/HTTPS: All traffic between client and API is encrypted with TLS 1.3 (minimum)
• Web Application Firewall: AWS WAF and Cloudflare DDoS protection block malicious traffic patterns before reaching the API
• IP Allowlisting: Institutional deployments can restrict API access to specific IP ranges
• VPC Isolation: Infrastructure runs in private subnets; outbound traffic goes through NAT gateways; no direct internet-facing database
• DDoS Mitigation: Cloudflare protects against volumetric and application-layer DDoS attacks

Data Protection and Privacy

Encryption Standards

• In Transit: TLS 1.3 for all HTTP/HTTPS and internal service-to-service communication
• At Rest: AES-256 for databases, object storage, and backups
• Credentials: API keys and tokens are hashed (bcrypt) or encrypted before storage
• Password Hashing: User passwords use bcrypt with salt rounds ≥10; plaintext passwords are never logged or transmitted internally

Access Control and Segmentation

• Role-Based Access Control (RBAC): Five permission levels (Owner, Admin, CFO, Analyst, Viewer) control access to Platform features and data
• Row-Level Security (RLS): Database enforces that users can only query their own tenant's data, even if SQL access were compromised
• Principle of Least Privilege: Employees have access only to systems and data required for their role
• MFA (Multi-Factor Authentication): All administrative access requires OIDC + TOTP or hardware key authentication
• Audit Logging: Every admin action, data access, and configuration change is logged immutably

Data Retention and Deletion

• User-Controlled Deletion: You may delete portfolios, holdings, and reports at any time through the Platform UI. Data is purged from primary storage within 24 hours.
• Backup Retention: Deleted data remains in encrypted backups for 90 days for disaster recovery. After 90 days, all copies are deleted permanently.
• Account Deletion: Upon account termination, personal data is deleted (except audit logs, which must be retained for legal compliance).
• No Data Resale: We do not monetize, resell, or use your Client Data for secondary purposes. Aggregated, anonymized statistics may be used for product improvement only.

GDPR and Data Residency

• Data Storage: All personal data and Client Data are stored in EU data centers (AWS eu-central-1, eu-west-1, or equivalent) by default
• Data Processor Agreement: We execute Data Processing Agreements (DPAs) with all institutional clients as required under GDPR
• Data Subject Rights: You have full rights to access, correct, delete, and port your personal data as defined in GDPR Articles 15–22
• DPO Contact: Our Data Protection Officer is available at support@aureumfrontiers.com

Monitoring, Logging, and Incident Response

Continuous Monitoring

• Real-Time Alerts: Automated systems monitor for unauthorized access attempts, failed authentications, unusual data access patterns, and performance anomalies
• Security Information and Event Management (SIEM): Centralized log aggregation and correlation detect coordinated attacks and intrusions
• Intrusion Detection: Network IDS/IPS (Intrusion Detection/Prevention System) monitors for known exploit signatures and behavioral anomalies
• Uptime and Availability: Prometheus metrics and Grafana dashboards track the Platform against a 99.5% availability target

Structured Logging

All Platform events are logged in structured JSON format with ISO 8601 timestamps, enabling precise forensic analysis:

• Authentication events (login, MFA, session expiry)
• Data access (which portfolio accessed, which user, when)
• Configuration changes (user roles modified, API keys created)
• System events (API errors, performance degradation, service restarts)
• Calculation events (model run, backtesting job, export generated)

Logs are encrypted and retained for 7 years to satisfy regulatory audit requirements.

Incident Response Plan

Incident Detection: Automated monitoring and alert systems trigger immediate investigation upon detection of:

• Unauthorized access attempts or privilege escalation
• Data exfiltration or unusual data transfers
• Service unavailability or performance degradation
• Malware or vulnerability exploitation
• Misconfiguration or security policy violations

Response Procedures:

1. Contain (0–1 hour): Isolate affected systems; revoke compromised credentials; restore from clean backups if necessary
2. Investigate (1–24 hours): Forensic analysis to determine scope, timeline, and root cause; preserve evidence
3. Notify (ASAP, per GDPR): If a breach affects personal data, we notify affected individuals and relevant authorities within 72 hours
4. Remediate (24–72 hours): Patch vulnerabilities; strengthen access controls; implement preventive measures
5. Post-Incident Review (1 week): Root-cause analysis; lessons learned; security improvements to prevent recurrence

Transparency: We will keep you informed of any incident affecting your data with regular status updates and final incident reports.

Compliance and Governance

Regulatory Framework

• GDPR (General Data Protection Regulation): Full compliance with EU data protection law; Data Processing Agreements available upon request
• Financial Services Authority (AFM/DNB) Expectations: While Aureum Sentinel is not a regulated financial institution, we design for compliance with Dutch financial supervision standards where applicable
• MiFID II / UCITS: Portfolio data and analytics are structured to support compliance with European investment fund regulations
• SOC 2 Type II (in progress): We are pursuing a third-party audit covering security, availability, and confidentiality controls

AI and Model Governance

Deterministic Algorithms: All analytical models (VaR, scenario analysis, stress testing, derivative pricing) are deterministic mathematical algorithms, not machine learning black boxes. This ensures:

• Reproducibility: Given the same inputs and model version, outputs are identical down to floating-point precision
• Explainability: Every calculation is mathematically transparent and auditable
• Governance: Model changes are explicit, versioned, and never applied retroactively

Model Risk Management:

• All models are documented with assumptions, limitations, and validation results
• Backtesting frameworks compare model predictions to realized outcomes
• Model versions are immutable; users can select which version to use for historical consistency
• Sensitivity analysis is available to understand model behavior under different parameter regimes

Optional AI-Powered Agent: An advanced AI agent is available for exploratory queries (market analysis, portfolio discussion). This agent provides informational insights only and is explicitly not a decision authority or financial advisor. Agent reasoning is logged for auditability.

Third-Party Risk Management

• Vendor Assessment: All third-party vendors (cloud providers, data providers, security tools) undergo security and compliance assessments before engagement
• Contractual Requirements: Data processors execute Data Processing Agreements (DPAs) with security and confidentiality clauses
• Ongoing Monitoring: We monitor vendor compliance through regular audits and security questionnaires
• Incident Notification: Vendors are contractually required to notify us of security incidents within 24 hours

Testing and Validation

Security Testing

• Vulnerability Scanning: Automated scanners run daily against infrastructure and application code
• Code Security Analysis: Static analysis tools (SAST) and dependency scanning (SCA) are integrated into the CI/CD pipeline
• Security Patch Management: Critical security patches are deployed within 24–48 hours; non-critical patches are batched into monthly releases

Operational Testing

• Disaster Recovery Drills: Quarterly simulations of backup recovery and failover procedures to ensure RPO (Recovery Point Objective) and RTO (Recovery Time Objective) targets are met
• Load Testing: Stress tests simulate peak usage to ensure scalability and performance under high concurrency
• Data Integrity Checks: Automated checksums and validation rules ensure data consistency across replicas

Calculation Validation

• Unit Tests: Every calculation function has comprehensive test coverage
• Integration Tests: End-to-end tests validate complete workflows (portfolio upload → calculation → report generation)
• Regression Tests: New releases are validated against historical data to ensure backward compatibility and accuracy
• Third-Party Validation: Where applicable, outputs are cross-validated against published benchmarks (e.g., VaR against academic datasets)

Transparency and Reporting

Security Disclosures

Responsible Disclosure: If you discover a security vulnerability, please email support@aureumfrontiers.com with full details. We ask that you allow 90 days for remediation before public disclosure. We will acknowledge receipt within 24 hours and keep you updated on progress.

Vulnerability Bounty: We currently do not offer a formal bug bounty program, but we recognize and credit security researchers who responsibly report issues.

Audit Reports

SOC 2 Type II (in progress): The audit is not complete. Once it is, we will make the report available under NDA on request. Contact support@aureumfrontiers.com for current security documentation.

Security Documentation: Current security documentation is available upon request for qualified institutional customers.

Status Page

Platform status, including availability and scheduled maintenance, is available on request.

Contact

For security inquiries:

Email: support@aureumfrontiers.com
PGP Key: available upon request
Data Protection Officer: support@aureumfrontiers.com
Privacy: support@aureumfrontiers.com