Cybersecurity Policy

Last Updated: January 27, 2026

At BullBrain.ai, cybersecurity is fundamental to our operations and our commitment to protecting your financial data and trading activities. This Cybersecurity Policy outlines the comprehensive security measures, practices, and standards we implement to safeguard our platform, your information, and our infrastructure against cyber threats.

Data Classification and Handling

We classify and handle data according to its sensitivity and regulatory requirements:

Highly Confidential Data

  • •User passwords (hashed with PBKDF2 + salt)
  • •JWT tokens and session keys
  • •Financial account information

Confidential Data

  • •Trade history and portfolio positions
  • •User email addresses and personal information
  • •Trading strategies and risk preferences
  • •Performance metrics and analytics

Internal Data

  • •System logs and audit trails
  • •Application configuration files
  • •Infrastructure monitoring data

Public Data

  • •Market data from public sources
  • •Platform documentation and policies

Access Control and Privileged Access Management

We implement strict access controls to protect sensitive systems and data:

  • Principle of Least Privilege: Users and services are granted minimum access required to perform their functions
  • Multi-Factor Authentication (MFA): Required for all administrative access to cloud infrastructure and production systems
  • Role-Based Access Control (RBAC): Kubernetes RBAC policies enforce service-level permissions and namespace isolation
  • JWT Token Authentication: 24-hour token expiration with secure session management
  • Privileged Access Monitoring: All administrative actions are logged and audited
  • Service Account Management: Dedicated service accounts with scoped permissions for inter-service communication
  • Regular Access Reviews: Quarterly reviews of user permissions and access rights
  • Immediate Revocation: Access is immediately revoked upon employee departure or role change

Encryption of Data at Rest and in Transit

Data in Transit

  • •TLS 1.3: All external communications encrypted with TLS 1.3
  • •HTTPS Enforcement: All web traffic redirected to HTTPS via Cloudflare
  • •API Communications: All API calls to third-party services use HTTPS
  • •Internal Service Mesh: Kubernetes service-to-service communication within secure cluster network
  • •Certificate Management: Automated SSL/TLS certificate renewal and management

Data at Rest

  • •Database Encryption: All sensitive data encrypted in PostgreSQL/SQLite databases
  • •API Credentials: All API keys encrypted with AES-256-GCM
  • •Password Storage: PBKDF2 hashing with 100,000 iterations and random salt
  • •Volume Encryption: Kubernetes persistent volumes use Vultr block storage encryption
  • •Backup Encryption: All database backups encrypted before storage
  • •Key Management: Encryption keys stored in Kubernetes Secrets with RBAC protection

Vulnerability Management and Patch Management

We maintain a proactive approach to identifying and remediating security vulnerabilities:

Vulnerability Scanning

  • •Automated dependency scanning for Python and Node.js packages
  • •Docker image scanning for known CVEs before deployment
  • •Regular security audits of application code and infrastructure
  • •Continuous monitoring for security advisories from vendors

Patch Management

  • •Critical Patches: Applied within 24-48 hours of release
  • •High Priority Patches: Applied within 7 days
  • •Standard Updates: Deployed during monthly maintenance windows
  • •Testing Protocol: All patches tested in staging environment before production
  • •Rollback Capability: Kubernetes rolling deployments enable quick rollback if issues arise

Zero-Day Response

For zero-day vulnerabilities, we maintain an emergency response protocol to assess impact, implement mitigations, and deploy patches as soon as available from vendors.

Incident Response and Disaster Recovery

Incident Response Plan

Our incident response process follows industry best practices:

  • •Detection: 24/7 automated monitoring and alerting for security events
  • •Containment: Immediate isolation of affected systems to prevent spread
  • •Investigation: Root cause analysis using audit logs and system forensics
  • •Eradication: Removal of threat and closure of security gaps
  • •Recovery: Restoration of services from secure backups
  • •Post-Incident Review: Lessons learned and security improvements implemented
  • •User Notification: Prompt notification to affected users as required by law

Disaster Recovery

  • •Automated Backups: Daily automated backups of all databases and configurations
  • •Recovery Time Objective (RTO): 4 hours for critical services
  • •Recovery Point Objective (RPO): Maximum 24 hours of data loss
  • •Geographic Redundancy: Backups stored in multiple geographic locations
  • •Testing Schedule: Quarterly disaster recovery drills and backup restoration tests
  • •Business Continuity: Documented procedures for maintaining operations during incidents

Physical Security

While BullBrain.ai operates as a cloud-native application without on-premises infrastructure, we rely on our cloud provider's physical security measures:

Vultr Cloud Infrastructure Security

  • •SOC 2 Type II certified data centers
  • •24/7 physical security with biometric access controls
  • •Video surveillance and security personnel
  • •Fire suppression and environmental monitoring systems
  • •Redundant power supplies and network connectivity

Our team members work remotely and are required to follow security best practices including encrypted devices, screen locks, and secure home networks.

Vendor Risk Management

We carefully evaluate and monitor all third-party vendors that have access to our systems or data:

Vendor Selection Criteria

  • •SOC 2 Type II or equivalent security certifications required
  • •Security assessment and due diligence before onboarding
  • •Review of vendor data handling and privacy practices
  • •Contractual security and compliance obligations

Critical Vendors

OpenAI (AI Services)

SOC 2 Type II certified, enterprise-grade security, data privacy commitments

Vultr (Cloud Infrastructure)

SOC 2 Type II certified, ISO 27001 compliant, GDPR compliant

Cloudflare (CDN and Security)

ISO 27001, PCI DSS, SOC 2 Type II certified, DDoS protection

Ongoing Vendor Monitoring

  • •Annual security certification reviews
  • •Monitoring of vendor security incidents and breaches
  • •Regular review of vendor security practices and policies
  • •Vendor security questionnaires and risk assessments
  • •Contingency plans for vendor service disruptions

Security Monitoring and Logging

We maintain comprehensive security monitoring and audit logging:

  • •Centralized Logging: All services log to centralized system for analysis
  • •Audit Trails: Comprehensive logging of authentication, authorization, and data access events
  • •Anomaly Detection: Automated detection of suspicious activity patterns
  • •Log Retention: Security logs retained for minimum 1 year
  • •Real-time Alerts: Immediate notification of critical security events

Employee Security Training

All BullBrain.ai team members undergo security training:

  • •Security awareness training upon hiring
  • •Annual refresher training on security policies and procedures
  • •Phishing and social engineering awareness
  • •Secure coding practices and OWASP Top 10 awareness
  • •Incident reporting procedures and escalation protocols

Policy Updates

This Cybersecurity Policy is reviewed and updated annually or as needed to reflect changes in our security practices, technology landscape, or regulatory requirements. Material changes will be communicated to users via email and posted on our platform.

Security Contact

If you have questions about our cybersecurity practices or wish to report a security vulnerability, please contact us:

Email: [email protected]

Responsible Disclosure: We welcome security researchers to report vulnerabilities through responsible disclosure

© 2026 BullBrain.ai. All rights reserved.