Isolation, least privilege and a record you can verify.
Vestoris is built so that a firm's data stays the firm's, every action is permitted explicitly, and the record of what happened cannot be changed quietly.
Strict tenant isolation
Every firm is a separate tenant. Every table carries the firm and every query is scoped to it; asking for another firm's record by its number returns "not found". Automated tests try exactly that on every page.
Entitlements on every action
Roles cap what a user may ever do; per-account grants say where. The check runs on the server for every request and again on every path toward execution. Refusals are logged and explained.
A tamper-evident event log
One append-only log for every component. Each row carries the SHA-256 of the previous row, so altering or removing a row breaks the chain, which you can verify in the app. The database itself refuses updates and deletes to the log.
Encryption
HTTPS everywhere, with HSTS. AI prompts and answers and copilot conversations are encrypted at rest with AES-256-GCM, using a key kept outside the web folders.
Sign-in
Passwords are hashed with a modern algorithm; sign-in forms have bot checks and attempt limits; sessions end after 30 idle minutes; Google sign-in is available for firm users. Sessions can be ended everywhere at once.
Safe defaults
A strict Content Security Policy with no third-party scripts, CSRF protection on every form, prepared database statements only, and no analytics trackers in the app.
Four eyes
The person who enters an order cannot approve it; the person who drafts a rule cannot approve it. Both are enforced in code and logged.
Paper trading only
This version has no broker connectivity and moves no money. Orders and fills are simulated, so the platform can be evaluated without operational risk.
Our staff and your data
Vestoris support works from counts and account controls (how many users, orders or alerts a firm has) and does not browse firms' portfolios. The demo sandboxes are separate tenants, private to each visitor, and are deleted automatically after 24 hours without use.
Reporting a vulnerability
Please write to support@vestoris.com with the details. We will acknowledge it and keep you informed.
See it with your own eyes, in ten minutes.
Open a private sandbox firm with sample accounts, rules and orders. No sign-up, no email. Switch roles and follow the guided tour.