Public evidence

Security evidence

Controls The Trade Talk currently operates, together with the assurance work that has not been completed.

Identity and session handling

Operator attested

WorkOS AuthKit provides sign-in and session identity. Sensitive Convex functions independently require authenticated accounts and resource authorization.

This is an implementation statement, not a claim that every public and private route uses the same middleware.

Tenant and participant authorization

Operator attested

Organization, project, order, contract, payment, calendar, brand, and communication operations use membership, ownership, or participant checks in Convex.

Authorization tests cover critical boundaries; this publication does not claim formal certification.

Payment and contract integrity controls

Operator attested

Payment state changes require provider verification. Contract OTP signatures are bound to an exact contract version and evidence record.

The Trade Talk is not an escrow service and does not guarantee provider availability.

Independent penetration test or security certification

Not available

No external penetration-test report, SOC 2 report, ISO certificate, or recurring third-party audit is published.

No such assurance should be inferred from product security language.

Publication sign-off

Signed off by: The Trade Talk Product Operations
Operator: Last Land Information Technologies LLP
Reviewed: 15 July 2026
Assurance type: Operator publication sign-off; not independent assurance

Security evidence

Controls The Trade Talk currently operates, together with the assurance work that has not been completed.

Identity and session handling

Operator attested

WorkOS AuthKit provides sign-in and session identity. Sensitive Convex functions independently require authenticated accounts and resource authorization.

This is an implementation statement, not a claim that every public and private route uses the same middleware.

Tenant and participant authorization

Operator attested

Organization, project, order, contract, payment, calendar, brand, and communication operations use membership, ownership, or participant checks in Convex.

Authorization tests cover critical boundaries; this publication does not claim formal certification.

Payment and contract integrity controls

Operator attested

Payment state changes require provider verification. Contract OTP signatures are bound to an exact contract version and evidence record.

The Trade Talk is not an escrow service and does not guarantee provider availability.

Independent penetration test or security certification

Not available

No external penetration-test report, SOC 2 report, ISO certificate, or recurring third-party audit is published.

No such assurance should be inferred from product security language.

Publication sign-off

Signed off by: The Trade Talk Product Operations
Operator: Last Land Information Technologies LLP
Reviewed: 15 July 2026
Assurance type: Operator publication sign-off; not independent assurance