Security

Atom Trade is a terminal, not a broker. It never holds your funds and never takes custody of your securities. There is no Atom Trade wallet, no pooled account and no ledger of your money, because your money never passes through us.

You connect your own account at your own SEBI-registered broker. Orders you place in the terminal are relayed to that broker under your own credentials and are settled by them, in your name. Your cash and holdings stay where they already are.

The practical consequence: if Atom Trade disappeared tomorrow, your positions and your balance would be untouched and still visible in your broker’s own app.

The API keys, access tokens and PINs you supply to connect a broker are encrypted before they are written to the database, using AES-256-GCM.

• Unique IV per credential. Every value is encrypted under a freshly generated random initialisation vector. IVs are never reused across credentials, which is what stops two identical stored values from producing identical ciphertext.
• Authenticated encryption. GCM produces an authentication tag alongside the ciphertext. Decryption verifies that tag and fails outright if the stored data has been altered by so much as one bit — so a database write we did not make cannot be silently fed back into a broker call.
• Key hygiene is enforced in code. The master key must be exactly 32 bytes of hex, and a key with too few distinct bytes is rejected at startup rather than accepted, so a placeholder key can never quietly reach production.

• Never stored in plaintext, and never recoverable. We store a bcrypt hash at cost factor 12. We cannot tell you what your password is, because we do not know it.
• Checked against known-breach corpora. At sign-up and on every password change, the password is checked against the Have I Been Pwned corpus of publicly breached passwords, and rejected if it appears even once. The check uses a k-anonymity range query: only the first five characters of a hash leave our server, so the password itself is never transmitted.
• Length over composition. The minimum is 12 characters. We do not impose “one uppercase, one digit, one symbol” rules — following NIST SP 800-63B, those push people toward predictable passwords without adding real strength.

Atom Trade runs entirely in AWS ap-south-1 (Mumbai). Application servers, the database and backups are all in that region.

• The production database is an Amazon RDS PostgreSQL instance with no public endpoint. It is not addressable from the internet; it accepts connections only from inside our private network.
• Database storage is encrypted at rest at the volume level.
• Automated backups with point-in-time recovery are retained inside the same region.

Every state-changing action on your account — signing in, connecting or disconnecting a broker, placing, modifying or cancelling an order, enabling or disabling MFA, tripping the kill switch — is written to a per-user audit log.

Those records are hash-chained. Each entry carries a sequence number and a SHA-256 hash covering both its own contents and the hash of the entry before it. Editing or deleting any single record breaks every link after it, and replaying the chain detects exactly where.

To be precise about what that buys: this is tamper-evident, not tamper-proof. It does not make alteration impossible — it makes silent alteration impossible to hide, which is the property that matters when there is a dispute about what you instructed and when.

• All traffic to the application and to the market-data WebSocket proxy is served over TLS. There is no plaintext HTTP path into the product.
• We send HTTP Strict Transport Security with a two-year max-age, includeSubDomains and preload, so a browser refuses to talk to us over anything but HTTPS — including on the very first request, once the domain is in the preload list.
• Session cookies are HTTP-only and scoped so they are readable by the application and the WebSocket proxy, and by nothing else.

If you have found a security issue in Atom Trade, we want to hear about it. Email security@atomtrade.in. We acknowledge reports within five business days.

Machine-readable contact details are published at /.well-known/security.txt. Our full policy — what is in scope, what is not, and the safe-harbour commitment for good-faith research — is maintained as SECURITY.md in our source repository; email the address above and we will send you a copy.

In short: in scope are app.atomtrade.in and the ws.atomtrade.in market-data proxy. Out of scope are denial-of-service testing of any kind, social engineering, and unvalidated scanner output without a working proof of concept. Please test only against your own account, never degrade the service during market hours, and give us reasonable time to ship a fix before disclosing publicly.

We do not currently operate a paid bug bounty and do not pay for reports. We offer a real response from an engineer, an honest severity assessment, and public credit if you want it.