Security Policy

This page explains how T2MA Labs LLC ("we", "us") protects Fips and your data, and how security researchers can report a vulnerability to us.

1. How we protect your data

• Encrypted connections: our websites, apps and API use HTTPS. The API also sends HSTS headers, so browsers only connect to it over HTTPS.
• Passwords: stored only as salted hashes, never in plain text. You can also sign in with Google or Apple.
• Read-only trading access: to connect a MetaTrader 5 account we ask only for its investor (read-only) password, which cannot place trades or move money.
• Infrastructure: our websites, API, database and file storage run on Cloudflare, which protects them against attacks such as DDoS and malicious bots. Our hosting providers encrypt stored data at rest.
• Access control: every API request is authenticated and limited to the signed-in user's own data, and requests are rate-limited. Access to production systems is limited to the people who need it.
• Less data to lose: we never receive your full card number. Payments are handled by our payment provider, Apple or Google.
• Deletion: you can delete your account and its data at any time, as described in our Privacy Policy.

2. What you can do

• Use a strong password that you do not use anywhere else.
• Keep your devices and apps up to date.
• Never give anyone your broker's trading (master) password. We will never ask for it, and we will never ask for your Fips password by email or in chat.

3. Reporting a vulnerability

If you believe you have found a security problem, email [email protected] with "Security" in the subject line. Please include:

• a description of the issue and its possible impact;
• the affected URL, app and version;
• steps to reproduce it.

Please give us a reasonable time to fix the issue before you disclose it publicly.

4. Scope

In scope: fipsapp.com and its subdomains (including app.fipsapp.com and api.fipsapp.com) and the official Fips mobile and desktop apps.

Please do not:

• run denial-of-service attacks or load tests;
• use spam, social engineering or phishing against our users or team;
• attempt physical attacks on our offices or infrastructure;
• access, change or delete other users' data; use only accounts you own;
• run automated scans that send large volumes of requests.

Vulnerabilities in third-party services we use should be reported to those providers.

5. Safe harbor

If you act in good faith and follow this policy, we will not take legal action against you for your research. When we receive your report, we will:

• confirm that we received it;
• work with you to understand and verify the issue;
• tell you when it is fixed.

6. Security incidents

If a security incident affects your personal data, we will inform you and the relevant authorities as the law requires.

7. Contact

T2MA Labs LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA. Email: [email protected]