Security
Built for the day someone tries.
Brokerages hold other people's money and identities. GarnetSync is built so that a stolen password, a stolen session or a careless click can't move money, and so that every change leaves a record nobody can rewrite.
- When
- 2026-10-29 14:05:02 UTC
- Who
- Mara Lind, Finance manager
- What
- brand.approval_threshold_changed
- Brand
- Corvane Markets
- Before
- { "threshold": "1000.00" }
- After
- { "threshold": "2500.00" }
- IP
- 203.0.113.24
- Browser
- Mozilla/5.0 (Macintosh) Chrome/141.0
01 Signing in
Two factors, and limits that give nothing away.
Guessing is rationed per address and per network, and the answers read the same whether an account exists or not.
- Two-factor, always
- Two-factor is mandatory for every staff account: a password and an authenticator code at every sign-in.
- 5 codes, 10 an hour
- A sign-in gets 5 tries at its code, and a person 10 wrong codes an hour, across every sign-in.
- 20 wrong passwords
- per address every 15 minutes, at most 5 of them from one network. An address with no account counts the same, so the limits give away nothing about who has one.
- Argon2id
- Passwords are hashed with Argon2id, and must be at least 12 characters.
- 12 hours, 2 idle
- A staff session lasts 12 hours at most, and ends after 2 hours without use.
- Clients too
- A client's sign-in adds an emailed code on any new device, under the same 12-hour and 2-hour limits.
02 Step-up
A fresh code holds for 5 minutes, on one sign-in.
Being signed in isn't enough for the changes that matter. Each of these needs an authenticator code confirmed in the last 5 minutes, on that sign-in only:
- Approving a deposit, withdrawal, credit or correction
- Answering Needs a person
- Saving an MT5 connection
- Changing a brand's approval threshold
- Moving a portal to a new domain
- Resetting an account's MT5 password
- Closing a position from the desk
- Handing over ownership
- 14:02:10 Enters a code from the authenticator
- 5 minutes, this sign-in onlyuntil 14:07:10
- 14:03:31Approves a 4,200.00 USD withdrawal1 of 2 approvals. No code asked: the window is open.
- 14:05:02Changes the brand's approval thresholdRecorded in the audit log, before and after.
- 14:08:44 Answers a Needs a person itemThe window has closed: a fresh code is asked for first.
14:04:00 The same person on a second device is asked for a code: the window belongs to the sign-in, not the person. A stolen session cookie alone can't approve anything.
03 Who sees what
Isolation in the database, not in the screens.
A screen with a bug can show too much. A database that refuses the row can't, so that's where the line is drawn.
- 58 tables
- Row-level security is on 58 tables, so the database itself limits every query to the company and the brands a person works on.
- Their own rows
- A client's database role reads only that client's own rows.
- 30 permissions, 9 roles
- A person holds up to 10 roles, and Who can do what shows their combined rights in one place.
- No self-promotion
- Nobody can give a role or a brand beyond what they hold themselves, or change their own access.
- One owner
- A company has one owner. Ownership moves only by handover, with a fresh code on both sides.
- Unlocks, rationed
- Support can unlock a person at most once an hour, and that person is emailed when it happens.
04 Money
Two people when the money says so.
Maker-checker is a database rule, the same for every role, so no screen or script can skip it.
- 1,000 USD
- The default threshold. A person may approve their own request only while it, plus their own requests and approvals for that client over 24 hours, stays within it.
- Any other currency
- Always needs a second person, whatever the amount.
- 1 of 2 approvals
- A portal deposit or withdrawal above the threshold needs two different people. The first approval sends nothing.
- 14 days
- Whoever changed a client's email, or sent them a sign-in link, can't approve that client's portal money for 14 days.
- Nothing rewritten
- No role can delete or rewrite ledger entries, requests or accounts. Nothing is deleted: MT5 accounts are archived instead.
- Payment details
- Changing the bank or crypto details clients pay to takes a fresh code, is recorded before and after, and emails your managers.
05 Documents
Passports that never leave our servers.
Clients upload proof of identity and of address. No role can approve KYC without both, each accepted and virus-clean.
- JPEG, PNG or PDF
- checked by their bytes, not their name, up to 10 MB each.
- AES-256-GCM
- Each file is encrypted with a key of its own.
- ClamAV, beside the API
- The scanner runs next to GarnetSync, so a document is never sent elsewhere to be checked.
What a scan can say
- CleanCan be opened by the people allowed to, and every opening is logged.
- FlaggedNever opened. It's recorded on the client's activity, and the brand's compliance people are told.
- No answerA scanner that errs, drops the line or stays silent never counts as clean. The document waits, and is scanned again.
06 Secrets and servers
Keys that are written, never read back.
Secrets
MT5 manager passwords and Xoala keys are encrypted with AES-256-GCM, write-only, and never shown back to anyone. Clients' trading passwords are never emailed: a client reveals one after a fresh code, and staff never see it.
Hosting
Amazon Web Services in London, with an encrypted private database and no SSH to the servers. Cloudflare issues each portal's certificate, and its Turnstile bot check on sign-up fails closed.
Cloudflare
CloudflareYour MT5 login
GarnetSync asks for a manager with no delete, Configuration or Administration rights, reachable only from our fixed IP, working on demo groups first. A refused sign-in is never retried until the connection is saved again, so MT5's lock-out can't be tripped.
The rights, step by step07 Tested every release
Every release runs 510 API tests, then 8 walks through the product in a real Chrome browser, with 744 checks.
Each walk uses the product the way a person does, in the browser, before a release ships.
Found something?
Write to us through the contact page with what you found and how to reproduce it.
Where to next
Bring your security questions.
Your compliance team will have a list. Send it to us, and we'll answer it against the rules on this page.