Encryption in Transit

All data transmitted between your browser and our servers is protected using TLS 1.2+ (HTTPS). We enforce HTTPS across all pages and API endpoints. No data is ever sent over unencrypted connections.

Encryption at Rest

Sensitive credentials and personal data stored by GhostStudio are encrypted using AES-256, the same standard used by financial institutions and government agencies. Encryption keys are stored separately from the encrypted data and are rotated periodically.

Payment Security

We never handle or store your payment card information. All payment processing is delegated to Stripe, which maintains PCI-DSS Level 1 compliance — the highest level of certification available in the payments industry.

Infrastructure Security

• Cloudflare CDN & DDoS protection — all traffic is routed through Cloudflare's global network, providing protection against distributed denial-of-service attacks.
• Minimal data retention — we keep only the data necessary to provide the service. Data is purged when no longer needed.
• Access controls — internal systems use role-based access controls. Only authorized personnel can access production systems.
• Dependency auditing — our software dependencies are regularly reviewed for known vulnerabilities.

Responsible Disclosure

If you discover a security vulnerability in our service, we ask that you disclose it responsibly. Please email us at charstractrading@gmail.com with a description of the issue. We will investigate all reports and respond promptly. We ask that you give us reasonable time to address the issue before public disclosure.

What We Don't Do

• We do not sell your data to advertisers or data brokers.
• We do not share your personal information with third parties except as described in our Privacy Policy.
• We do not store plain-text credentials.
• We do not use third-party tracking or advertising scripts.

Questions?

If you have any security concerns or questions about how we protect your data, please contact us at charstractrading@gmail.com. We take all security inquiries seriously and will respond within 24 hours.