06 / Data & Security
Where data lives, who reaches it.
Keystone is read-only infrastructure. It reads positions, computes risk and produces evidence-backed reports. It never holds assets, keys or trading permissions. The controls below describe where data resides and how access is governed.
Data residency
All data processing occurs within the European Union.
A single encrypted EU datastore holds all application data. No third-party object storage.
Controls
Data residency
All data is processed and stored within the European Union, on established cloud infrastructure.
Read-only connectivity
You create the API key and choose its permissions. Keystone only ever calls read endpoints and never requests withdrawal, transfer or trading scope, but it does not inspect what a key is permitted to do, so a read-only key is yours to set and yours to verify on the venue.
Encryption
Encrypted in transit (TLS) and at rest (AES-256), across compute and storage.
Credential handling
Venue credentials are encrypted with AES-256 before they are stored, and the encryption key itself is held in a managed secret store, never in source code.
Access control
Role-based access: administrator, viewer, and auditor roles, over authenticated sessions.
Infrastructure security
Deployments use federated identity with no long-lived keys. Application sign-in is email and password over authenticated sessions; two-factor authentication is not yet enforced.
Audit & evidence
Risk-state transitions are recorded in an append-only audit trail, with evidence bundles attached to report outputs.
Data footprint
All application data resides in a single encrypted EU datastore. No third-party object storage.
Access model
Access is role-based, over authenticated sessions. Three roles are defined:
Administrator
Manages configuration and access.
Viewer
Reads risk state and reports.
Auditor
Reviews the audit trail and evidence.
Read-only posture
Read-onlyKeystone observes and reports. It does not place, modify or route orders.
No custodyIt never holds assets, keys or client funds. Positions are read, never controlled.
No trading permissionsKeystone requests no withdrawal, transfer or trading scope and calls only read endpoints.
Diligence
A one-page security overview is available to forward to security and operational-diligence teams. Further detail is available to institutional counterparties under an executed agreement.