Uncharted Investing
Log in

Cybersecurity Policy

Security Controls & Data Protection Framework
Alpaca Markets Compliance | Last Audit: January 30, 2026

I. Access Control & Identity Management

Uncharted Investments implements enterprise-grade access controls to protect member accounts and system integrity. Our identity management framework exceeds Alpaca Markets' security requirements.

FIDO2/WebAuthn MFA
Hardware security keys (YubiKey) required for all administrative access. Phishing-resistant authentication eliminates credential theft vectors.
Role-Based Access Control
Granular permissions based on role (Admin, Manager, Member). Principle of least privilege enforced across all system functions.
Session Management
Automatic session timeout after inactivity. Secure session tokens with rotation. Concurrent session limits per user.
Audit Logging
Comprehensive logging of all authentication events, permission changes, and administrative actions. Immutable audit trail.
Zero Trust Architecture: Every access request is verified regardless of source. No implicit trust based on network location or previous authentication.

II. Endpoint & Network Protection

Our infrastructure security controls protect against external threats and ensure secure communication between all system components.

Network Security

  • VPC Isolation: Trading systems operate in isolated virtual private clouds with strict egress filtering.
  • Alpaca-Only Egress: Outbound connections restricted to Alpaca API endpoints only.
  • TLS 1.3: All data in transit encrypted using TLS 1.3 with strong cipher suites.
  • DDoS Protection: Cloud-based DDoS mitigation with automatic traffic scrubbing.

Endpoint Security

  • No SSH/RDP: Remote shell access eliminated. All management via secure session managers.
  • EDR: Microsoft Defender for Endpoint deployed on all systems with real-time threat detection.
  • Application Whitelisting: Only signed, approved binaries permitted to execute.
  • Full Disk Encryption: BitLocker AES-256 encryption on all storage volumes.
Network Segmentation: Trading systems, member portals, and administrative functions operate in separate network segments with controlled communication paths.

III. Data Security & Digital Vault

Member data and API credentials receive the highest level of protection through encryption, access controls, and secure storage practices.

Encryption Standards

Data Type Encryption Key Management
OAuth Access Tokens AES-256-GCM Azure Key Vault (HSM-backed)
Refresh Tokens AES-256-GCM Azure Key Vault (HSM-backed)
Member PII AES-256 Managed encryption keys
Database (at rest) TDE (AES-256) Azure SQL managed
Backups AES-256 Geo-redundant storage

API Key Auditing

Continuous monitoring of all linked Alpaca accounts ensures compliance with our non-custodial model:

  • 24/7 Automated Audits: API permissions checked every 4 hours for all linked accounts.
  • Withdrawal Detection: Any account with withdrawal permissions triggers immediate disconnect.
  • Permission Alerts: Real-time notifications for any permission scope changes.
  • Compliance Dashboard: Administrative visibility into all member API status.
Zero Tolerance Policy: Accounts detected with withdrawal permissions are automatically disconnected from the Club. This policy is non-negotiable and protects all members.

IV. Operational Failsafes

Multiple failsafe mechanisms ensure system stability and member protection during adverse conditions.

Dead Man's Switch

The Dead Man's Switch is an automated safety mechanism that activates if the system detects critical failure or loss of administrative oversight:

  • Heartbeat Monitoring: System health checked every 60 seconds.
  • Automatic CLub Halt: Trading suspended if heartbeat fails for 5 consecutive checks.
  • Position Protection: Existing stop-loss orders remain active during halt.
  • Admin Notification: Immediate alerts via SMS and email to all administrators.

Club Halt Protocol

Administrators can trigger a manual Club Halt during:

  • Extreme market volatility (VIX > threshold)
  • Black Swan events or market circuit breakers
  • Detected security incidents
  • System maintenance windows
Graceful Degradation: During Club Halt, the system continues monitoring but suspends new trade execution. Members retain full access to their Alpaca accounts for manual trading.

V. Vulnerability & Incident Response

Proactive security measures and defined response procedures ensure rapid detection and remediation of security events.

Vulnerability Management

  • Dependency Scanning: Automated scanning of all code dependencies for known vulnerabilities.
  • Code Signing: All production releases signed with EV Certificate.
  • Penetration Testing: Annual third-party security assessments.
  • Bug Bounty: Responsible disclosure program for security researchers.

Incident Response Plan

Severity Response Time Actions
Critical 15 minutes Club Halt, incident commander activated, Alpaca notification
High 1 hour Investigation initiated, affected systems isolated
Medium 4 hours Security team review, remediation plan developed
Low 24 hours Logged for review, addressed in next maintenance window

Member Notification

In the event of a security incident affecting member data or accounts:

  • Affected members notified within 72 hours of confirmed breach
  • Clear description of incident scope and potential impact
  • Recommended protective actions for members
  • Ongoing updates until incident resolution
Security-First Culture: All team members receive security awareness training. Security considerations are integrated into every development and operational decision.

VI. Compliance Framework

Our security controls align with industry standards and regulatory requirements:

Control Area Implementation Status
Multi-Factor Authentication FIDO2/WebAuthn (YubiKey) Active
Data Encryption (Rest) AES-256 / TDE Active
Data Encryption (Transit) TLS 1.3 Active
API Key Auditing 24/7 Automated Active
Endpoint Detection Microsoft Defender Active
Full Disk Encryption BitLocker AES-256 Active
Code Signing EV Certificate Active
VPC Isolation Azure VNet Active
Continuous Compliance: Security controls are reviewed quarterly and updated as needed to address emerging threats and regulatory changes.