Trust is the product. So we engineer for it.
Security & Trust
Commodity trade runs on confidence: in your counterparty, your paperwork, and the platform holding it all. Here is exactly how we protect your data and where our compliance data comes from.
Platform security
Defense in depth, by default.
Encryption in transit & at rest
All traffic is served over TLS 1.3, and data is encrypted at rest with AES-256. Document contents are additionally encrypted at the application layer (AES-256-GCM) under a key held outside the database.
Authorization on every route
Postgres Row-Level Security scopes data to its owner. Every API route authenticates the session before doing anything.
Logged, disclosed staff access
Staff have no routine access to your document or deal contents. The rare break-glass exception requires a typed reason, is written to an append-only audit log, and is always disclosed to you in-app and by email.
Multi-factor authentication
Optional MFA on accounts, and a trust-score bonus for enabling it. Sensitive actions are gated behind a fresh session.
Bot & abuse protection
Cloudflare Turnstile guards auth flows. Sensitive endpoints are rate-limited (screening, password reset, uploads, data export).
Hardened HTTP headers
HSTS with preload, X-Frame-Options DENY, nosniff, a strict Referrer-Policy, a locked-down Permissions-Policy, and a reporting CSP.
Safe inputs & uploads
Zod validation on every API route, a strict file-type allow-list with size caps, and HTML escaping across all email templates.
Self-hosted document reading
Optical character recognition runs entirely on our own servers. The text read from your uploaded documents is encrypted at rest and used only for advisory checks and search; it is never sent to any AI provider or external partner.
Data & privacy
Your data, your rights.
GDPR by design
A documented privacy policy with legal bases, sub-processor disclosure, and a cookie-consent layer with granular controls.
Export your data
One-click GDPR data export of your account, rate-limited to protect against abuse.
Delete your account
Permanent account deletion with cascading removal of your records, gated behind explicit confirmation.
You own your records
Your documents, deals, and passports are yours. We never sell your data, access is least-privilege by default, and any privileged staff access to your account record is logged and disclosed to you.
Independence
Operated independently.
TradeFlow Software, LLC builds and runs the platform. It shares common ownership with GBF Services, a commodities trading firm, but operates independently: your trade, deal, counterparty, and document data is never shared with any affiliate for their own commercial or trading use. That separation is not just a promise, it is enforced by the controls above. Staff have no routine access to your document or deal contents; the rare break-glass exception requires a typed reason and is disclosed to you; document contents are encrypted under a key held outside the database.
Compliance methodology
Where the screening data comes from.
Ensemble matching, not naive string search
Candidates are retrieved with Postgres trigram similarity (pg_trgm), then re-ranked by an ensemble that combines name similarity, phonetic matching, identifier corroboration, and demographic consistency, with built-in transliteration of Cyrillic, Arabic, and Chinese scripts. That catches aliases, transliterations, and word-order swaps that plain matching misses, and returns a FLAG, REVIEW, or PASS with a confidence score and risk tier.
Kept fresh on a schedule
The lists are synced from their official sources automatically: critical lists daily, most weekly, and the long-tail monthly, and Business Verification extends AML and sanctions coverage to 1300+ global lists. No stale data, no manual exports.
Transparency
Sub-processors.
The third parties that help us run the platform. Each is bound by a data-processing agreement.
Supabase
Database, auth, storage (Postgres + RLS)
Vercel
Application hosting & edge network
Stripe
Payments & subscription billing
Resend
Transactional email
Didit
KYC, KYB, and AML/sanctions screening
Groq
AI features (LLM inference)
Cloudflare
Turnstile bot protection
Mapbox
Provenance maps
Google Analytics
Consent-gated product analytics
Found a vulnerability?
Report it responsibly and we will work with you to fix it quickly.