MindGuard Security
Last updated: April 2026 · v1.0 · security@mindguardai.io
MindGuard is a read-only, observational tool — it never places orders, moves funds, or writes to any broker account. This page describes our security architecture, threat model, and compliance posture for partner, enterprise, and user review.
1. What MindGuard does — and does not — do
We process
- Email + bcrypt password hash
- Broker API tokens (encrypted at rest)
- Trade data — positions, fills, P&L (read-only)
- Behavioral signals — mental scores, alerts
- Session debriefs (user-written notes)
- Auth event IP logs (30-day auto-purge)
We never do
- Place orders or trades
- Move or transfer funds
- Store broker passwords
- Process payment card data
- Record keystrokes or clipboard content
- Share data with advertisers or third parties
2. Encryption
| Layer | Implementation | Standard |
|---|---|---|
| Data at rest | AES-256-GCM · 12-byte random IV per record · 16-byte auth tag · key stored outside DB | NIST SP 800-38D |
| Data in transit | TLS 1.2+ enforced · WSS only · HSTS via Helmet | TLS 1.2 / 1.3 |
| Passwords | bcrypt cost factor 12 · no plaintext · no reversible encoding | OWASP |
| Database | Neon Postgres · sslmode=require · AWS us-east-1 | SOC 2 Type II |
3. Authentication & Access Control
- Access tokens: JWT HS256, 1-hour TTL, Redis blacklist on logout
- Refresh tokens: Rotating, 30-day TTL, bcrypt-hashed, race-condition safe (advisory lock)
- 2FA / MFA: TOTP (RFC 6238) + 8 bcrypt-hashed recovery codes, optional
- Rate limiting: 60 req/min on login, 3/15min on password reset, account lockout after 5 failures
- Multi-tenancy: Every database query scoped to
WHERE user_id = $1— no cross-user queries possible - Input validation: Zod schemas on every API route, parameterized SQL throughout, no string concatenation
4. Chrome Extension Security (MV3)
- Manifest V3: No
eval(), no remote code execution, explicit minimalhost_permissions - Local storage:
chrome.storage.local— extension-isolated, inaccessible from other extensions or page scripts - CSP:
script-src 'self'; object-src 'none' - Distribution: Chrome Web Store only — CRX3 signature verification at install
5. Logging & Observability
- Pino structured logging with auto-redaction of
password,token,authorization,creditCard - No request body logging on auth routes
- Sentry error tracking — 10% sample rate, 5xx errors only, no trading data or email addresses included
- IP logs auto-purge after 30 days
6. Incident Response
- Detection: Sentry + auth-event rate alarms + Render uptime monitoring
- Containment: Token revocation (individual or mass via JWT
iatfloor), IP blocking - User notification: Within 72 hours of confirmed breach (GDPR Art. 33)
- Post-mortem: Written within 7 days, shared with affected users
7. Compliance Roadmap
| Milestone | Target | Status |
|---|---|---|
| Privacy Policy + Security Whitepaper | Q2 2026 | ✓ Done |
| Vulnerability disclosure program | Q2 2026 | ✓ Done |
| Vanta / Drata continuous compliance monitoring | Q3 2026 | Planned |
| SOC 2 Type I audit | Q4 2026 | Planned |
| SOC 2 Type II | Q2 2027 | Roadmap |
MindGuard is not currently SOC 2 or ISO 27001 certified. The controls above align with SOC 2 Trust Services Criteria (Security, Confidentiality, Availability). A full control mapping is available on request.
8. Vulnerability Disclosure
Report vulnerabilities to security@mindguardai.io.
- Acknowledgement within 48 hours
- Initial triage within 5 business days
- Critical patch target: 30 days
- Safe harbor for good-faith researchers who avoid data destruction and report before public disclosure