Skip to main content
NOVABASTIONMarket Intelligence
Security boundary

Security at NovaBastion

Access model

Sign-in identifies your account. Each protected request checks current permissions on the server. Signing in does not create an account or grant additional access.

Core controls

  • Server-authoritative account permissions and dataset checks
  • Server-required MFA architecture for Owner, Admin, and future external users, with challenge, short idle and absolute sessions, rotation, recovery, and revocation
  • No-store protected responses and service-worker network-only private paths
  • Bounded inputs, same-origin mutation checks, rate limits, audit events, and secret-minimized logs
  • Customer market data, billing, brokerage, execution, autonomous trading, NOVA Quant, and HFT remain OFF

Implementation and automated tests do not close the live external-user MFA certification gate; authenticated production evidence is still required.

Reporting

Report suspected vulnerabilities to security@novabastion.ai. Do not include secrets, cookies, provider credentials, payment-card data, or unrelated personal information. Do not test outside written authorization.