Security architecture
Vanguardia Financial is built the way a financial platform should be, even in its MVP form. Account security isn't a feature we bolted on afterward — it's the same foundation a production trading system would need before handling a single real dollar.
Authentication
Every credential and session is designed so that a leaked database or an intercepted request still can’t hand over your account.
- Passwords hashed with bcrypt — never stored or logged in plain text
- Short-lived JWT access tokens (15 min) limit the damage window of a stolen token
- Rotating refresh tokens, individually revocable, replace long-lived sessions
- Two-factor authentication (TOTP) architecture for a second, device-bound factor
Session & Device Control
You can see, at any time, everywhere your account is signed in — and end any session you don’t recognize instantly.
- Per-device session tracking, separate from any other device you use
- Revoke any session remotely from Security settings, no support ticket needed
- Full login history with timestamp, IP address, and user agent
- Suspicious login detection architecture flags unusual access patterns
Data & Accounting Integrity
Your balance is never a field someone typed a new number into — it is always the output of a verifiable transaction history.
- Immutable, append-only transaction ledger backs every balance shown
- No direct balance edits, ever — even administrators can only add ledger entries
- Full audit log of every administrative action, tied to the acting admin
- Role-based access control gates every admin-only function
Platform Hardening
The infrastructure around your account is hardened the same way a production financial system would be.
- Rate limiting on authentication and other sensitive endpoints
- Strict CORS configuration limiting which origins can call the API
- Secure HTTP security headers on every response
- Environment-based secrets management — nothing sensitive hardcoded in source
Our commitment to transparency
This platform combines real market data with a fully managed trading ledger, holding ourselves to a strict transparency standard: any value not independently derived from a live market feed — including administrator-configured data — is clearly identified as such in the product itself. See our Risk Disclosure for the full picture.