Security at the Core of XSiDER

At XSiDER, security is considered throughout the design, development, deployment and operation of our trading technology.

Our platform supports business-critical workflows for brokerages, proprietary trading firms and financial institutions. We therefore recognise the importance of protecting systems, business information and personal data against unauthorised access, misuse, disruption and loss.

Our security approach covers application security, identity and access management, data protection, infrastructure, monitoring, operational controls and third-party integrations.

Security controls and their implementation may vary according to the product, hosting arrangement, deployment architecture and contractual requirements.

XSiDER uses authentication and access-control mechanisms designed to protect platform accounts and administrative functions.

Depending on the application and deployment, supported capabilities may include:

• Token-based authentication using JSON Web Tokens (JWT).
• Short-lived and rotated session tokens where configured.
• Two-factor authentication (2FA), including supported TOTP and WebAuthn methods.
• Single sign-on (SSO) and SAML-based enterprise identity integration where configured.
• Biometric authentication through supported mobile-device capabilities.
• Account security and profile-management functionality.

Authentication methods available to a user depend on the application and the configuration enabled for the relevant client deployment.

XSiDER supports role-based access control (RBAC) to help businesses manage access to administrative and operational functions.

Access permissions can be configured according to the user's assigned role and responsibilities.

Administrative controls may cover:

• User and account management.
• Manager and operational access.
• Platform configuration.
• Security-related settings.
• Trading and risk-management functions.
• Reporting and audit information.

Businesses should apply the principle of least privilege by granting users only the access required to perform their assigned responsibilities.

XSiDER's published platform security capabilities include encryption in transit and AES-256 encryption at rest.

These controls are intended to protect information exchanged between supported platform components and information stored within supported infrastructure environments.

The precise encryption configuration, key-management arrangements and data-protection controls depend on the deployment and hosting architecture.

Where applicable, secure HTTPS connections are used for website and application access. Clients should ensure that their own domains, certificates and connected systems are correctly configured.

XSiDER provides integration capabilities that may include REST APIs, WebSocket connectivity, FIX connectivity and webhooks.

Depending on the integration and deployment, API security capabilities may include:

• OAuth 2.0 authentication.
• Authenticated access to protected API resources.
• Encrypted communication channels.
• Controlled access to connected services.
• Separation between public read-only endpoints and authenticated platform operations, where applicable.

Clients integrating with XSiDER are responsible for protecting their own API credentials, securing connected applications and managing access to their systems.

API credentials must not be published in public repositories, exposed in client-side code or shared with unauthorised parties.

Specific requirements such as IP allow-listing, credential rotation and network restrictions should be agreed during technical implementation.

XSiDER uses modern infrastructure and software technologies to support the operation of its platform.

Its published technology stack includes components such as:

• Cloud infrastructure and deployment services.
• Containerized application services.
• Nginx and other web-tier components.
• PostgreSQL database services.
• Redis data services.
• Kafka and event-driven processing components.
• Independently deployable application services.

Infrastructure and deployment arrangements may vary according to client requirements and the selected hosting model.

Network segmentation, firewall rules, dedicated environments, regional deployment and other infrastructure controls are assessed and configured according to the relevant deployment.

Operational visibility is an important part of maintaining platform security and reliability.

Depending on the deployment, XSiDER provides monitoring and audit capabilities that may include:

• Application and service monitoring.
• Platform and integration diagnostics.
• Liquidity and market-data connection monitoring.
• Searchable audit trails.
• Administrative activity records.
• Trading and operational reporting.
• Detection and investigation of unusual system behaviour.

Audit records support operational investigation and accountability. Retention periods, access restrictions and export capabilities depend on the relevant configuration and contractual requirements.

XSiDER undertakes technical maintenance and development activities intended to maintain the security and reliability of its software.

Security-related activities may include:

• Reviewing application and infrastructure configurations.
• Applying relevant software and security updates.
• Investigating reported vulnerabilities.
• Reviewing access permissions.
• Testing changes before deployment, where appropriate.
• Addressing identified technical weaknesses according to their severity and risk.

The timing and scope of maintenance depend on the nature of the issue, the affected service and the deployment arrangement.

Independent penetration testing, external audits and security certifications should only be considered applicable where they have been specifically completed and documented. No certification or independent audit status is implied by this page.

XSiDER maintains an operational approach for identifying, assessing and responding to security incidents affecting its technology and services.

Where an incident is identified, the response may include:

1. Identifying and assessing the reported incident.
2. Determining the affected systems, services and information.
3. Taking appropriate containment measures.
4. Investigating the cause and potential impact.
5. Implementing corrective or recovery actions.
6. Communicating with affected clients where required.
7. Reviewing the incident and identifying improvements.

Where personal data is involved, notification and cooperation will be handled in accordance with applicable data protection law and relevant contractual obligations.

Clients should promptly report suspected security incidents affecting their XSiDER deployment through their designated support or security contact.

Backup, recovery and business-continuity arrangements depend on the hosting model, deployment architecture and applicable service agreement.

Where backup and recovery services are included in a deployment, the applicable arrangements should specify the relevant responsibilities, frequency, retention periods and recovery objectives.

Clients should confirm their required backup, disaster-recovery and business-continuity arrangements during implementation and ensure that responsibilities are documented.

This Security page does not establish a specific recovery time objective (RTO), recovery point objective (RPO) or guaranteed uptime commitment.

XSiDER may integrate with independent third-party providers for services such as:

• Cloud hosting and infrastructure.
• Liquidity and execution connectivity.
• Payment processing.
• Identity verification and KYC/AML services.
• Email, messaging and communications.
• Other external software and technology services.

Third-party providers operate under their own security practices, agreements and privacy policies.

The security, availability and regulatory status of a third-party service are not guaranteed merely because an integration is supported by XSiDER.

The relevant client is responsible for assessing third-party providers used in its business and determining whether their services meet its legal, regulatory and operational requirements.

Security is a shared responsibility between XSiDER and the businesses using its technology.

Clients are responsible for:

• Protecting their user accounts and authentication credentials.
• Assigning appropriate roles and permissions.
• Securing their own devices, networks and connected applications.
• Managing API keys, tokens and integration credentials.
• Training their employees on security practices.
• Promptly reporting suspected unauthorised access.
• Complying with applicable data protection and regulatory requirements.
• Managing the security of third-party services under their control.

Clients operating regulated financial businesses remain responsible for their own regulatory obligations, including any requirements relating to cybersecurity, operational resilience, record keeping and customer data.

Business clients may request relevant technical and security information during the evaluation, procurement or implementation process.

Subject to confidentiality, availability and the applicable contractual arrangements, this may include:

• Platform architecture information.
• Technical security documentation.
• Integration and authentication requirements.
• Infrastructure and deployment information.
• Available audit or assessment documentation.
• Security and operational control information.

Any security assessment, audit or testing engagement must be agreed separately where required.

If you believe you have identified a security vulnerability, unauthorised access or other security concern involving XSiDER's website or technology, please contact us through the details below.

Please include sufficient information to help us understand and investigate the issue. Do not publicly disclose suspected vulnerabilities or access, modify or extract information that does not belong to you.

We may update this page to reflect changes to our technology, security practices, infrastructure or operational procedures.

The latest version will be published on this page with an updated “Last Updated” date.