Security
Controls built into the platform
This page lists controls that exist in the code today. GetTbill is a demonstration environment, so please do not enter real financial details or documents.
Sign-in and sessions
Password storage
Passwords are hashed with Argon2. Repeated failures lock the account for a short period, and sign-in responds the same way whether or not an account exists.
Multi-factor authentication
Time-based authenticator codes that cannot be replayed, with recovery codes stored only as hashes and usable once.
Session handling
Sessions sit in HttpOnly cookies behind a same-origin proxy, with a CSRF token on state-changing requests.
Refresh token rotation
Refresh tokens are single use. If a used token comes back, all sessions in that family end and a security event is recorded.
Records and financial integrity
Double-entry ledger
Journals must balance before they post, and corrections are made by reversal.
Audit log
Audit entries are linked in a hash chain, so a changed or removed entry breaks the chain and shows up in reconciliation.
Reconciliation
Scheduled checks compare journals, holdings, lots, simulated custody and the audit chain. They report differences and never adjust them.
Live trading guard
The server refuses to start if live trading or live payments are enabled, or if it is pointed at a production environment.
People and access
Role-based permissions
Staff roles such as operations, finance, compliance, support and read-only auditor each carry a limited set of permissions.
Maker-checker approvals
High-risk actions, such as ledger corrections and MFA resets, are recorded as requests that a different person must approve.
Sensitive field encryption
Authenticator secrets are encrypted at rest using a dedicated key.
Web protections
Input validation on every endpoint, rate limits, security headers and a restricted set of allowed origins.
What has not been done
- No independent penetration test or security audit has been completed.
- No certification or compliance attestation, such as SOC 2 or ISO 27001, is held or claimed.
- The demonstration environment is not hardened for production use or for real customer data.
Found a security issue?
Tell us through the contact form and choose Support as the topic. Please do not include real credentials.