SECURITY POSTURE DISCLOSURE
This page summarizes the technical and organizational security controls that protect the ONG Trades platform and its users. It is intended to support institutional due diligence, counterparty evaluation, and SOC 2 readiness review. Questions or security reports may be directed to security@ongtrades.com.
1. Overview
ONG Trades, Inc. operates an institutional-grade digital marketplace for physical energy commodity trading. Given the sensitivity of counterparty data, transaction records, and compliance documentation processed by the platform, security is a first-class engineering priority. Our security program is designed around a zero-trust architecture, defense in depth, least-privilege access, and continuous verification.
2. Encryption
2.1 Encryption in Transit
All traffic to and from the platform is encrypted using TLS 1.2 or higher. HTTP Strict Transport Security (HSTS) is enforced at the edge. We disable legacy cipher suites and protocols and continuously monitor for compliance with modern TLS configuration standards.
2.2 Encryption at Rest
Data at rest is encrypted using AES-256. Database storage, object storage, and backup artifacts are all encrypted at rest by our infrastructure providers. Highly sensitive artifacts (KYC documents, signed agreements, voice recordings) are additionally stored in access-scoped buckets with per-object access policies.
2.3 Key Management
Cryptographic keys are managed through cloud-native key management services with automated rotation. A hardware security module (HSM) solution with FIPS 140-2 Level 3 compliance is planned for a future phase. Service-role credentials and API keys are stored exclusively in AWS Secrets Manager, injected into services at runtime, and are never committed to source control.
3. Identity, Authentication & Access Control
3.1 Authentication
User authentication is handled through Amazon Cognito, with single sign-on via federated identity providers available for enterprise customers. Multi-factor authentication is enforced for administrative, compliance, and auditor roles, with platform-wide MFA enforcement planned at general availability.
3.2 Role-Based Access Control (RBAC)
The platform implements a five-tier RBAC model covering administrator, compliance officer, auditor, trader, and investor view roles. Permissions are evaluated on every request and enforced both at the API layer and at the database layer via PostgreSQL Row Level Security (RLS) policies, evaluated on every request.
3.3 Row Level Security
Every user-facing database table is protected by RLS policies. Policies check authentication state and ownership/membership before allowing read or write access. Administrative-only tables require explicit admin claims, and all RLS policies are reviewed during each security audit cycle.
4. Infrastructure Security
The platform runs entirely on Amazon Web Services (AWS) managed infrastructure, with shared-responsibility controls for physical security, network isolation, and hypervisor hardening inherited from AWS. An AWS Web Application Firewall (WAF) is deployed in front of all public services and actively filters malicious traffic; AWS provides network-layer DDoS protection. Application-layer rate limiting further protects public endpoints from abuse.
- Isolated production, staging, and demo environments with separate credentials and databases
- The production database is not publicly accessible; administrative access is available only through an ephemeral, identity-authenticated session tunnel with no standing credentials
- Secrets managed exclusively through AWS Secrets Manager and injected at runtime
- Immutable, environment-specific build artifacts with reproducible deployments
- Continuous dependency scanning and vulnerability assessment
5. Six-Layer Compliance Architecture
Every trade flowing through the platform is evaluated across six compliance layers before execution is authorized:
- Layer 1 — Onboarding: KYC/KYB identity verification, sanctions screening, PEP checks
- Layer 2 — Product: Product documentation, refinery validation, allocation chain
- Layer 3 — Logistics: FOB/CIF verification, vessel nomination, inspection coordination
- Layer 4 — Inspection: Third-party certificates, quality and quantity verification
- Layer 5 — Financial: LC/SBLC verification, bank validation, SWIFT messaging
- Layer 6 — Execution: Laycan monitoring, demurrage, discharge, authorization
Every verification and authorization decision is persisted to an immutable audit log with the acting user, timestamp, previous state, and new state, supporting SOC 2 CC6.1 evidence collection.
6. Monitoring, Logging & Incident Response
The platform emits structured application logs, authentication logs, and compliance audit logs to Amazon CloudWatch. Operational alarms are configured and routed to the on-call operator. Incidents are triaged against real-time log streams and CloudWatch dashboards.
Our incident response process covers detection, containment, eradication, recovery, and post-incident review. Customer-affecting incidents are communicated through the platform notification system and, where applicable, by direct email to affected users within the timelines required under GDPR, the UK Data Protection Act 2018, and applicable U.S. state breach notification laws.
7. SOC 2 Readiness
ONG Trades is actively pursuing SOC 2 Type I certification for its security controls, with engagement of an independent CPA firm and a third-party penetration test as the next planned steps toward a Type II examination. Our internal security assessment cadence continuously tracks findings across the Trust Services Criteria, with a findings register maintained for remediation traceability.
This is a voluntary, transparent disclosure. We do not currently hold SOC 2 Type I or Type II certification, and we do not over-represent our compliance posture.
8. Security Audit Cadence
The platform is subject to a recurring security audit program. Each audit produces a numbered findings register capturing severity, area, status, and remediation. The audit history is retained indefinitely, and a delta report is produced after every audit cycle. Prior assessment versions are available to qualified reviewers under NDA.
9. Responsible Disclosure
We welcome reports from the security research community. If you believe you have identified a vulnerability, please report it privately to security@ongtrades.com. Reports should include a clear reproduction path, affected endpoints or components, and any proof-of-concept material necessary for triage.
We commit to the following:
- Acknowledgement of receipt within two (2) business days
- An initial triage assessment within five (5) business days
- Coordinated disclosure timelines for confirmed vulnerabilities
- Good-faith safe harbor for research conducted consistent with this policy — no legal action will be taken against researchers who report vulnerabilities responsibly and avoid service disruption, data exfiltration, or access to accounts other than their own
Out of scope: denial-of-service testing, social engineering of ONG Trades personnel, physical attacks, and testing against production data belonging to other users.
10. Vendor and Third-Party Security
We conduct security reviews of every third-party service that handles customer data, including sanctions and company-registry screening providers (OpenSanctions, Companies House), identity verification (Stripe Identity), authentication (Amazon Cognito), signature services (PandaDoc), the Blockchain for Energy (B4E) consortium (Hyperledger FireFly infrastructure), and B4E Carbon. Each integration is governed by a data processing agreement and reviewed on renewal.
11. Contact
ONG Trades, Inc.
Attn: Security Team
Highland Park, TX
Security reports: security@ongtrades.com
Privacy inquiries: privacy@ongtrades.com
Legal: legal@ongtrades.com
For the detailed data-handling practices that complement this Security page, see our Privacy Policy and Terms of Service.