Overview
Security is foundational to Market Fortress because public-company customers entrust us with material non-public information. Our four-layer defense model is designed for this responsibility from the database to the AI inference layer.
Encryption
Data is encrypted at rest by our database and file storage provider (AES-256) and in transit over TLS.
Identity and Access
Authentication is managed via Supabase Auth. Two-factor sign-in is available, and we are making it required for administrative roles. Session tokens are short-lived JWTs with refresh-token rotation.
AI Services
AI features run through business AI services from Google and Anthropic.
Audit Trail
Key actions, such as filing marks, approvals and changes to governance records, are recorded with who did them and when. Deleted items go to a trash for 30 days before they are purged.
Monitoring and Incident Response
Continuous monitoring of authentication anomalies, rate limits, and structural integrity. We notify affected customers without undue delay after we confirm a breach of their data. A formal written incident response plan is in preparation.
Post-Quantum Hybrid Mode
Post-quantum hybrid key exchange (ML-KEM alongside classical algorithms) is on our security roadmap. Ask us for its current status.
Vulnerability Reporting
If you discover a security vulnerability, please report it to ace@marketfortress.app. We acknowledge within two business days and provide regular updates through resolution. We do not pursue legal action against good-faith researchers.
Documentation
We answer vendor risk questionnaires on request.