Security

1. Account security

• Strong password hashing — passwords are stored using industry-standard one-way hashing algorithms;
• Session protection — sessions use HTTP-only cookies and CSRF protection on every state-changing request;
• Login throttling — repeated failed login attempts are rate-limited;
• Email-based recovery — account recovery requires verified email access.

2. Data encryption

• In transit — all traffic to and from the platform is encrypted via TLS;
• At rest — databases, backups, and file storage are encrypted;
• Secrets management — API keys, credentials, and sensitive configuration are stored in encrypted secrets stores, never in code or logs.

3. Custody of digital assets

Client assets are held with regulated custody partners, separate from our operating funds. Custody arrangements include:

• Segregated accounts — client funds are not commingled with ForthDex operating funds;
• Multi-signature or multi-party approval for movements above defined thresholds;
• Cold-storage for the majority of long-term holdings;
• Insurance coverage for certain custody risks, subject to policy terms.

A portion of assets is held on-chain to support DeFi strategies and active trading. On-chain exposure is capped by policy and monitored continuously.

4. Identity verification (KYC)

We verify client identities using regulated third-party providers. This helps prevent fraud, money laundering, and account takeover. Your documents are stored encrypted and are only accessed by authorised personnel for compliance purposes.

5. Fraud monitoring

We monitor accounts, transactions, and login activity for patterns consistent with fraud or account takeover. When we detect anomalies, we may temporarily restrict account activity until we can verify the account holder's intent.

6. Infrastructure security

• Least privilege — internal access to production systems is limited to staff who need it, with audit logging;
• Patching — dependencies and operating systems are patched on a defined schedule;
• Backups — encrypted backups are tested regularly;
• Penetration testing — conducted periodically by independent security firms.

7. Incident response

If a security incident affects client accounts, funds, or personal data, we will:

• Contain and investigate the incident;
• Notify affected clients and regulators where required by law;
• Publish a post-incident summary where appropriate;
• Implement corrective measures to prevent recurrence.

8. What you can do

• Use a strong, unique password — never reuse credentials across services;
• Guard your email — your email account is the master key to your ForthDex account;
• Verify URLs — always check that you are on forthdex.com before entering login credentials;
• Double-check addresses — verify crypto destination addresses before submitting any withdrawal;
• Report suspicious activity — if you suspect your account is compromised, contact us immediately.

9. Reporting a security issue

If you believe you have found a security vulnerability, please email 4thdex@gmail.com with the subject line "Security". We investigate all reports and will acknowledge receipt within 2 business days.

We do not pursue legal action against researchers who act in good faith, report responsibly, and avoid accessing or modifying data that is not theirs.

10. Contact

Security-related questions: 4thdex@gmail.com
ForthDex Inc. · Michigan, USA