Security is built into the development lifecycle, not added at the end. This page describes what is implemented on this website and in our software, and what remains the responsibility of customers and third-party providers.
The public FOREXAA website implements the following browser and transport security controls.
HTTPS with HSTS (Strict-Transport-Security, includeSubDomains, preload).
Strict CSP with default-src 'self', object-src 'none', frame-src 'none'.
X-Content-Type-Options: nosniff on all responses.
X-Frame-Options: DENY and frame-src 'none' in CSP.
Referrer-Policy: strict-origin.
Camera, microphone, geolocation, payment and USB disabled.
COOP: same-origin, CORP: same-origin.
The FOREXAA platform and its components are built with security as a baseline requirement.
All user input validated with Zod schemas. Server is the only authority.
React escapes by default. No dangerouslySetInnerHTML except the documented JSON-LD boundary.
Parameterized queries via ORM. No string-concatenated SQL.
Environment variables only. No secrets in source. Server-only env access.
npm audit in CI. No destructive automated upgrades.
Branded error UIs. No stack traces, paths, env or SQL details exposed.
Abstraction with production interface. Contact forms rate-limited.
Structured JSON logs with key redaction. No PII in logs.
When customers deploy FOREXAA software, certain security responsibilities remain with them.
Role-based access control configured by the customer.
Customers own their client data and retention policies.
Customers manage their own firewalls, WAF and DDoS protection.
Customers are responsible for their own regulatory obligations.
Payment providers, liquidity sources and other integrations are configured by the customer.
This website does not load third-party scripts, analytics or remote widgets. All assets are self-hosted.
No Google Analytics, no GTM, no Clarity, no remote tracking.
All JavaScript and CSS is bundled and served from this origin.
Sora and Manrope variable fonts self-hosted at /fonts, no Google Fonts CDN.
No embedded third-party content.