Security
Quantivo handles credentials, trading research, and eventually licensed market data. The controls below are in place today in the development environment and are carried forward unchanged into production rather than added afterwards.
No long-lived cloud credentials
Deployments authenticate through OIDC federation with environment-bound roles that issue short-lived credentials. There are no static access keys stored in the repository or in CI configuration.
Private by default networking
Application and worker tasks run without public IP addresses. The database and cache are unreachable from the internet, and egress is restricted to explicitly declared destinations rather than allowed broadly.
Encryption in transit and at rest
Database connections require TLS, the cache enforces both in-transit and at-rest encryption, and object storage is encrypted with versioning enabled. Public access is blocked at the bucket level.
Secrets under managed encryption
Runtime configuration lives in AWS Secrets Manager under customer-managed KMS keys. Secret values are never written to logs, build output, or the repository, and rotation is gated behind human review.
Least-privilege access
Each automation role is scoped to the specific resources it needs. Privileged operations run in separate, reviewer-gated environments from routine deployments.
Immutable, scanned images
Every deployment references a container image by immutable digest. Images are scanned for vulnerabilities before release, and production dependency audits run as part of the pipeline.
Session security
Authentication uses secure, HTTP-only cookie sessions with rate limiting on both account and address. Public signup is disabled during private development, and privileged access requires explicit super-admin enforcement.
Append-only audit trails
Lineage and audit records cannot be updated or deleted — database triggers reject the attempt. Corrections are new revisions that supersede prior ones, so history remains reconstructable.
Untrusted content handling
Third-party text ingested from public sources is treated as untrusted input. It is never permitted to influence system instructions or trigger downstream automation.
Reporting a vulnerability
If you believe you have found a security issue, email security@getquantivo.com with enough detail to reproduce it. Please do not open a public issue, and give us a reasonable window to respond before disclosing.
Quantivo is in private development and has not yet completed a formal third-party audit or compliance certification. When that changes, this page will say so with a date attached.