Avenix Solutions LLC ("Optionscanner," "we") · Effective: August 29, 2026 · Contact: support@optionscanner.ai
This page describes how we protect the platform and your data. It is the public version of our internal cybersecurity policy, which is owned by the Managing Member, reviewed at least annually and after any material incident or architecture change.
We handle data in three tiers. Restricted data, brokerage OAuth tokens and API credentials, is stored only in a managed secrets service or encrypted database fields, is never written to logs, never sent to your browser, and never leaves the production environment. We deliberately do not collect government IDs or banking details; account opening and identity verification happen at your brokerage, not with us. Confidential data, your positions, orders, journal, watchlists, configuration, and email address, is stored with strict per-account isolation enforced in the application layer and database rules: no user can read another user's data, and shared analytics caches hold only derived, non-attributable values. Public data is the marketing site and educational content.
Human access to production systems is restricted to explicitly authorized, individually accountable personnel, granted per person on a least-privilege basis, with unique credentials and multi-factor authentication required on every administrative console. There are no shared accounts. Services run under least-privilege identities scoped to only the APIs they need, and deploy credentials are separate from runtime credentials. Your access to the application is authenticated on every request with server-side token verification, and administrative functions are gated by explicit role checks.
All traffic is encrypted in transit: public traffic terminates at a managed HTTPS load balancer, and every service-to-service and third-party call is HTTPS-only. All data is encrypted at rest, and brokerage OAuth tokens receive an additional layer of application-level encryption before storage. No customer data is stored on company workstations.
The production runtime is serverless: the cloud provider patches the host operating system continuously, and every deploy rebuilds the application from source, picking up dependency and base-image updates. Dependencies are pinned and monitored for security advisories, with high-severity issues targeted for patching within 7 days and critical ones within 72 hours. Every deploy supports immediate rollback to a known-good version, so security fixes ship with low risk.
A documented incident process defines detection, triage, and remediation. One safety rule shapes all of it: protective measures may stop new activity, but must never trap your open positions. Whatever happens on our side, you always retain direct access to your positions at your brokerage. If we suspect Restricted data has been compromised, we immediately revoke and rotate the affected credentials, review access logs, notify affected users without unreasonable delay consistent with applicable law, and notify affected partners where their systems are implicated. Every incident ends with a written post-incident review and corrective actions.
The database runs multi-region with point-in-time recovery, delete protection, and daily backups. Compute runs in an active region plus a warm standby in a second region behind a global load balancer that fails traffic over automatically. Recovery steps for a regional outage are documented and rehearsed as part of the operational plan.
Third-party services are inventoried and each receives only the data its function requires: our cloud provider (hosting, database, authentication, secrets), our payments provider (card data is handled entirely by them through hosted checkout and never touches our systems), your linked brokerage (only the order and account instructions you direct), and licensed market-data and AI providers (query content only, never personal information). New vendors are reviewed for security posture and data-handling terms before use, and vendor credentials are rotated on any suspicion of exposure.
Security questions or reports: support@optionscanner.ai. If you believe you have found a vulnerability, please include enough detail to reproduce it and we will respond promptly.