Security

How we protect your account and funds.

Encryption

All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 at the infrastructure layer provided by Supabase. Your password is never stored in plain text — it is hashed using bcrypt before storage.

Payment Security

We do not store credit card numbers, CVV codes, or banking credentials. All card processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. Card data never touches our servers.

Authentication

Account authentication is provided by Supabase Auth using industry-standard JWT tokens with short expiry windows. Sessions are invalidated on logout. We recommend using a strong, unique password for your Etheon account.

Access Controls

Access to production infrastructure is restricted to authorised personnel only. Our database uses row-level security policies to ensure users can only access their own data. Admin functions are gated behind separate role-based access controls.

Deposit Review

All deposits are subject to manual admin review before being credited to your account. This step exists to prevent fraud, errors, and unauthorised transactions. We will notify you once your deposit has been reviewed.

Responsible Disclosure

If you discover a security vulnerability in the Etheon platform, please report it to us at legal@etheon.io before public disclosure. We take all reports seriously and will respond within 48 hours. We ask that you give us reasonable time to investigate and address the issue before disclosure.

Please do not access or modify other users' data, perform denial of service attacks, or use automated scanning tools against our infrastructure.