Security at Optimus

Your backtesting history is the record of how you trade, and it deserves to be protected like any other sensitive data. We keep our attack surface deliberately small: customer sign-in goes through Google so there is no customer password to steal, card numbers never reach us, transport is encrypted everywhere, and data is strictly scoped to the account that created it.

• Customer sign-in is delegated entirely to Google OAuth — we never see, handle, or store your password. Public registration with a password is disabled.
• Sessions are managed with secure, HTTP-only cookies that JavaScript cannot read, and every session is recorded with the IP address and browser it was created from.
• Sessions expire automatically and can be ended at any time by signing out.
• Because your Google account is the key to your workspace, we strongly recommend enabling two-factor authentication on it.

All traffic between your browser and our servers is encrypted with TLS (HTTPS, TLS 1.2 or newer) with HTTP Strict Transport Security enabled. The database runs on cloud block storage that is encrypted at rest, and it is reachable only from the application over a private network — neither the database nor the application servers are exposed to the public internet; the only public entry point is our web proxy.

Every session, trade, and journal entry is bound to the account that created it, and every API request is authorized against that ownership before any data is returned. Other users can never read your backtesting data. Our own staff use dedicated administrator accounts whose privileges are re-checked against the database on every request, and access production data only when required to operate the service or resolve an issue you raise.

• The platform runs on Oracle Cloud Infrastructure on Ubuntu hosts that install security updates automatically.
• Administrative access to the servers is by SSH key only; password login is disabled.
• Secrets and credentials are kept in environment files with owner-only permissions on the server, never in source code or the container images.
• Application dependencies are kept up to date, and each release is built from a reviewed commit.
• Requests with a forged Host header, and probes for common vulnerable paths, are dropped at the proxy before reaching the application.

Paid plans are processed by PayPal, and by Stripe where it is enabled — both PCI-DSS Level 1 providers. Checkout happens on their pages; your card number or PayPal login goes directly to them and never touches or is stored on our servers. We store only the provider's customer and subscription identifiers and the status of your plan. Webhooks from both providers are verified by signature before we act on them.

The database is backed up regularly, including before every deployment, so your sessions and trade history can be restored in the event of a failure. Backups stay on the same encrypted storage as the database. Every service is health-checked, planned maintenance shows a status page instead of an error, and we will communicate transparently about any incident that affects your data or availability.

• Protect the Google account you sign in with, and enable two-factor authentication on it.
• Sign out when using a shared or public computer.
• Be wary of anyone asking you to share your screen or account while "helping" with your trading.
• Report anything that looks wrong — unexpected sessions, trades you did not place, or suspicious messages claiming to be from Optimus.

If you believe you have found a security vulnerability in Optimus, we want to hear about it. Send a report through the contact form at theoptimus.org/#contact with enough detail to reproduce the issue, and give us a reasonable window to fix it before public disclosure. We will acknowledge your report, keep you informed of progress, and credit you if you wish. Please do not access other users' data or degrade the service while testing.

Security questions or reports, and general questions: theoptimus.org/#contact.