Cybersecurity Policy

At QuantCraft, we are committed to protecting your data and maintaining the highest standards of security. This Cybersecurity Policy outlines the measures we implement to safeguard your information, secure our systems, and ensure the integrity of your trading operations. Our desktop application is designed with security at its core, and we continuously work to enhance our security posture.

Data Classification and Handling

QuantCraft processes and stores different types of data with varying sensitivity levels. We classify data into categories to ensure appropriate handling and protection measures are applied at every stage.

Highly Sensitive Data: This includes your QuantCraft authentication token, Alpaca OAuth tokens, cloud runner keys, and AI provider keys. On supported systems, these secrets are stored primarily in your operating system's credential store (Windows Credential Locker, macOS Keychain, or Linux Secret Service). If the OS credential store is unavailable, the app may fall back to the local application configuration file. We never transmit your Alpaca credentials to our servers. Alpaca OAuth tokens are short-lived and fetched at runtime; they are not persisted locally.

Trading and Financial Data: Your portfolio positions, account balances, transaction history, and order details are fetched from Alpaca in real-time and displayed within the application. This data is cached locally on your device for performance purposes and is protected with application-level security measures. Historical market data, charts, and backtest results are stored locally in your workspace and are not shared externally unless you explicitly choose to do so.

Strategy Code and Research: Your Python trading strategies, custom indicators, backtest configurations, and optimization parameters are stored locally within your QuantCraft workspace on your device. You maintain full control over this intellectual property, and it is not uploaded to any cloud service unless you use optional features that require it. We recommend backing up your strategy files regularly using your preferred backup solution.

Application Logs and Diagnostics: The desktop application generates local log files for debugging and performance monitoring. These logs may contain technical information about application operations but are designed to exclude sensitive credentials and personally identifiable information. Logs are stored locally and rotated automatically to manage disk space.

Access Control and Privileged Access Management

Access control is a fundamental principle of our security architecture. Because QuantCraft is a desktop application that runs on your personal computer, you are the primary controller of access to your data and trading operations.

Application-Level Authentication: QuantCraft uses authentication tokens (JWTs) to access optional cloud features and services. Your user token is stored primarily in your operating system's credential store when available, with the local application configuration file as a fallback, and is used only for authorized communication with QuantCraft services. Because the application runs locally on your device, the primary security boundary is your operating system's user account and file permissions. We strongly recommend using a strong, unique password for your OS user account and enabling additional security features your operating system provides, such as full-disk encryption.

OAuth Authentication: With OAuth, your long-term Alpaca credentials remain on QuantCraft's secure servers. Only a short-lived access token is fetched from QuantCraft at runtime and kept in memory; it is not persisted locally. The QuantCraft server handles the OAuth authorization-code exchange, and the application frontend never sees the Alpaca client secret. OAuth popup windows use isolated browser profiles so that session data does not leak between authentication attempts.

Cloud Runner and AI Provider Keys: API keys for optional cloud runner services and AI model providers are stored primarily in the OS keychain when available, with the local application configuration file as a fallback. Premium AI assistant credentials are not stored locally; they are fetched fresh from the QuantCraft backend each time they are used.

Operating System Security: Because QuantCraft runs locally on Windows, macOS, or Linux, the security of your device's operating system is critical. We recommend keeping your operating system updated, using strong user account passwords, enabling built-in security features like Windows Defender or macOS FileVault, and avoiding running the application on shared or compromised devices.

Multi-User Systems: If you use QuantCraft on a computer with multiple user accounts (family computer, shared workstation), be aware that other users with administrative privileges may be able to access your QuantCraft configuration files and API keys. On shared systems, use OAuth authentication instead of direct API keys, enable full-disk encryption, and consider using a separate computer or virtual machine for trading activities. Never use QuantCraft on systems where you don't trust all administrators.

Session Management: QuantCraft keeps trading and OAuth credentials in memory while the application is running. Short-lived Alpaca OAuth tokens are fetched at runtime and are not written to disk. Because the application runs locally, physical access to your device provides access to the application. We strongly recommend enabling your operating system's screen lock and configuring it to activate automatically after a short period of inactivity to prevent unauthorized access when you step away from your computer.

Encryption of Data at Rest and in Transit

Encryption is essential for protecting your data from unauthorized access, both when it's stored on your device and when it's transmitted over networks.

Data in Transit: All communication between QuantCraft and external services uses industry-standard Transport Layer Security (TLS) encryption. This includes:

• Alpaca API Communication: All requests to Alpaca's trading API (for market data, order placement, account information) are transmitted over HTTPS with TLS 1.2 or higher. This ensures that your API credentials, trading orders, and financial data cannot be intercepted by third parties during transmission.
• Market Data Feeds: Real-time and historical market data retrieved from Alpaca and other data providers is encrypted in transit to prevent tampering or eavesdropping.
• Software Updates: When QuantCraft checks for updates or downloads new versions, these communications are secured with TLS and verified with digital signatures to prevent malicious software from being installed.

Data at Rest: Sensitive data stored on your local device is protected primarily by your operating system's credential store:

• API Credentials (OAuth): When using OAuth authentication, your long-term Alpaca credentials remain on QuantCraft's secure servers, and only short-lived, revocable access tokens are kept in memory. No long-term Alpaca token is stored on your device.
• QuantCraft User Tokens and Cloud Keys: Your QuantCraft authentication token, cloud runner API keys, and AI provider keys are stored in the OS keychain when available, with the local application configuration file as a fallback.
• Backend Service Credentials: The QuantCraft local backend keeps service credentials in memory and loads them from environment variables. These credentials are not persisted to disk during normal operation, and the backend does not validate JWTs locally; tokens are verified by QuantCraft servers. Backend service credentials are rotated manually and require an application restart after updates.
• Configuration Files: Application configuration files are stored in your operating system's standard application data directory and are protected by file system permissions that restrict access to your user account. Secrets are stripped from these files before they are written to disk or exported whenever possible.
• Workspace Data: Your strategy code, backtest results, and research data are stored in your QuantCraft workspace directory. These files are not encrypted by default to allow for easy editing, backup, and version control. You can enable file-level encryption through your operating system's built-in tools or third-party encryption software if additional protection is desired.

Critical Security Recommendation: Because credential storage may fall back to plaintext local files when the OS keychain is unavailable, enabling full-disk encryption on your device is essential for protecting your credentials from physical theft or unauthorized access. Use BitLocker (Windows), FileVault (macOS), or LUKS (Linux). Where available, use OAuth authentication to avoid storing long-term credentials on your device.

Vulnerability Management and Patch Management

Maintaining a secure application requires continuous vigilance against emerging vulnerabilities and prompt application of security patches. QuantCraft employs a comprehensive approach to identify, assess, and remediate security vulnerabilities.

Application Updates: QuantCraft is updated regularly to address security vulnerabilities, fix bugs, and introduce new features. The application includes an automatic update checker that notifies you when a new version is available. We strongly recommend installing updates promptly, especially those marked as security updates. Critical security patches are prioritized and released as quickly as possible when vulnerabilities are discovered.

Dependency Management: QuantCraft is built on a foundation of third-party libraries and frameworks. We continuously monitor security advisories for all dependencies, including the Tauri framework (for the desktop application), Rust crates, WebView components, and build-time JavaScript dependencies. When vulnerabilities are identified in dependencies, we assess the risk, apply patches or upgrade to fixed versions, and release updated versions of QuantCraft to our users.

Python Environment Security: The integrated Python IDE allows you to install packages from PyPI (Python Package Index) to enhance your trading strategies. Important: Python code runs on your machine with the same permissions as your operating system user account and is not sandboxed. This means Python scripts and packages can:

• Read and write any files your OS user account can access
• Make arbitrary network connections and send data externally
• Execute system commands and other programs (e.g., via subprocess)
• Install additional packages or modify your Python environment
• Access environment variables and configuration files, including those containing credentials

This is appropriate for local development with code you trust, but carries risk with untrusted code. To protect yourself:

• Only install packages from trusted sources and well-maintained projects with active communities
• Review package documentation, download counts, maintenance activity, and community feedback before installation
• Be extremely wary of newly published packages, those with typo names similar to popular packages, or packages requesting unusual permissions
• Review the package's source code when possible, especially for security-sensitive operations
• Keep installed packages updated to their latest versions to receive security fixes
• Never run untrusted Python code with live trading API keys active—use paper trading accounts for testing

Security Testing: Our development team conducts regular security testing, including code reviews, static analysis, and penetration testing, to identify potential vulnerabilities before they reach production. We also welcome responsible disclosure from security researchers who discover vulnerabilities in QuantCraft.

Operating System and Platform Security:Because QuantCraft runs on your desktop operating system, we rely on the underlying platform's security features. We design the application to work with Windows, macOS, and Linux security mechanisms, including sandboxing where applicable. However, keeping your operating system updated with the latest security patches is essential for overall system security.

Incident Response and Disaster Recovery

Despite our best efforts to prevent security incidents, we recognize that no system is completely immune to threats. We have established procedures to detect, respond to, and recover from security incidents that may affect QuantCraft users.

Incident Detection and Response: We monitor for potential security incidents through various channels, including user reports, security research, automated monitoring systems, and security advisories from third parties. When a potential security incident is identified, our team follows a structured incident response process:

• Assessment: We quickly evaluate the nature and severity of the incident, determine what data or systems may be affected, and assess the potential impact on users.
• Containment: Immediate action is taken to contain the incident and prevent further damage, which may include releasing emergency patches, providing mitigation guidance to users, or temporarily disabling affected features.
• Investigation: We conduct a thorough investigation to understand the root cause, scope, and timeline of the incident.
• Communication: If an incident affects user data or security, we will notify affected users promptly via email or in-application notifications, providing clear guidance on any actions they should take to protect themselves.
• Remediation and Recovery: We develop and deploy fixes to address the vulnerability, assist affected users with recovery, and implement improvements to prevent similar incidents in the future.

User Data Backup and Recovery: Because QuantCraft stores your strategies, research, and configurations locally on your device, we strongly recommend implementing your own backup strategy. Consider:

• Regularly backing up your QuantCraft workspace directory to external storage or cloud backup services
• Important: Encrypt backups or ensure backup destinations are encrypted, especially if they contain configuration files with API keys
• Using version control systems like Git for your strategy code—but never commit API keys or credentials to version control, especially public repositories
• Be cautious with cloud backup services that may automatically sync your entire QuantCraft directory, potentially exposing plain-text credentials
• Testing your backup and recovery procedures periodically

Business Continuity: In the event of a major incident affecting our ability to provide updates or support, we have business continuity plans to restore services as quickly as possible. Because QuantCraft is a desktop application that operates independently once installed, you can continue using existing functionality even if our servers are temporarily unavailable. Your connection to Alpaca's trading API is direct and does not depend on QuantCraft's infrastructure.

Physical Security

Physical security is a critical but often overlooked aspect of cybersecurity. Because QuantCraft is a desktop application running on your personal computer, physical security of your device is essential to protecting your data and trading operations.

Device Security Recommendations: We recommend the following physical security measures for devices running QuantCraft:

• Device Encryption: Enable full-disk encryption on your computer to protect all data in case the device is lost or stolen. Use BitLocker (Windows), FileVault (macOS), or LUKS (Linux).
• Screen Locking: Configure your operating system to automatically lock the screen after a period of inactivity and require authentication to unlock. This prevents unauthorized access when you step away from your computer.
• Physical Access Control: Keep your device in a secure location when not in use. Avoid using QuantCraft on shared or public computers where others may have physical access to the device.
• Device Theft Prevention: Consider using laptop locks, secure workspaces, and device tracking software to reduce the risk of theft. If your device is lost or stolen, contact Alpaca immediately.
• Clean Desk Policy: When conducting sensitive trading activities, avoid displaying confidential information where it might be seen by others, especially in public or shared workspaces.

Disposal and Decommissioning: When you no longer use a device that has QuantCraft installed, properly wipe or destroy the storage media before disposal or resale. Simply deleting files is not sufficient—use secure erase tools provided by your operating system or drive manufacturer.

QuantCraft Infrastructure: While your data is stored locally, QuantCraft maintains limited cloud infrastructure for software distribution, update servers, and optional features. This infrastructure is hosted with reputable cloud providers who maintain rigorous physical security standards, including controlled access to data centers, surveillance, environmental controls, and redundant power supplies. We do not maintain our own physical data centers.

Vendor Risk Management

QuantCraft relies on several third-party vendors and services to deliver functionality. We carefully evaluate and monitor these vendors to ensure they meet our security and reliability standards.

Alpaca Trading Platform: Alpaca is our primary brokerage integration and the only broker currently supported for live and paper trading in QuantCraft. Alpaca maintains its own comprehensive security program, including:

• SEC-registered broker-dealer status with regulatory oversight
• TLS-encrypted API communication and secure authentication mechanisms
• SOC 2 Type II certification demonstrating security controls
• Segregated customer accounts and investor protection measures
• Regular security audits and penetration testing

QuantCraft communicates directly with Alpaca's API from your device—your credentials and trading requests never pass through QuantCraft's servers. You can review Alpaca's security practices and policies at alpaca.markets/security (opens in new tab).

Python Package Index (PyPI): The QuantCraft Python IDE allows you to install packages from PyPI to extend functionality and build sophisticated trading strategies. PyPI is the official third-party software repository for Python and hosts hundreds of thousands of packages maintained by the global Python community. While PyPI implements security measures including malware scanning and two-factor authentication for package maintainers, individual packages vary widely in quality and security.

Important: When you install a package from PyPI, that code runs with the same permissions as the QuantCraft application on your system. Malicious or poorly written packages could potentially access your files, network connections, or other resources. We recommend:

• Research packages before installation—check download counts, maintenance activity, and community reviews
• Prefer well-known packages with active maintainers and large user bases
• Review the package's source code if possible, especially for security-sensitive operations
• Be wary of newly published packages or those with typo names similar to popular packages
• Keep installed packages updated to receive security fixes

Cloud Infrastructure Providers: QuantCraft uses cloud infrastructure providers for hosting our website, update servers, and optional features. We select providers with strong security certifications (such as SOC 2, ISO 27001) and regularly review their security practices. These providers are responsible for the physical and network security of their infrastructure, while we are responsible for securing the applications and data we deploy on their platforms.

Software Dependencies and Open Source:QuantCraft is built using numerous open-source libraries and frameworks, including Tauri, Rust crates, React, and build-time JavaScript dependencies. We continuously monitor security advisories for all dependencies and apply updates promptly when vulnerabilities are discovered. We contribute back to the open-source community when appropriate and participate in security disclosure programs.

Vendor Security Assessment: Before integrating a new third-party service or dependency, we conduct a security assessment that includes reviewing their security documentation, certifications, incident history, and community reputation. We prefer vendors who are transparent about their security practices and have established track records.

Contact and Reporting

If you discover a security vulnerability in QuantCraft or have questions about our security practices, please contact us at contact@quantcraft.cc. We take all security reports seriously and will respond promptly to investigate and address any issues.

For general questions about this policy, data protection, or our security measures, you can also reach us through the in-application support system or our contact page. We are committed to transparency and will do our best to address your concerns.