How we protect your account.
A plain description of the security practices behind WaiTrade — not a compliance badge wall.
Password & authentication security
Passwords are hashed with bcrypt and never stored in plain text. Social login via Google, GitHub, and Discord uses standard OAuth 2.0 — WaiTrade never sees or stores your password on those providers.
Payments never touch our servers
Subscription payments are processed entirely by Stripe. WaiTrade does not store card numbers, CVVs, or full payment credentials on its own infrastructure at any point.
Session security
Sessions use signed, HttpOnly cookies. Admin and dashboard areas are gated server-side on every request, not just hidden client-side.
Least-privilege access
Admin-only actions (user management, financial ledgers, platform status) are checked against the account's role on the server for every request, independent of what the client sends.
Reporting a vulnerability
If you believe you've found a security vulnerability in WaiTrade, please report it through our contact form under the "Security" topic. Please include enough detail to reproduce the issue, and avoid accessing or modifying data beyond what's necessary to demonstrate it. We aim to acknowledge reports within 2 business days.
Platform status
For live operational status of the platform API, marketplace, authentication, payments, AI analysis, and Bot Builder, see System Status.