Encryption
Planned encryption for sensitive data in transit and at rest using approved services and managed key practices.
SECURITY AT CAPITAL EVOLVE
Trust is a system,
not a badge.
CapitalEvolve is building its security program with controls designed to support recognized security and compliance frameworks. This page describes intended practices, not completed audits or certifications.
PROGRAM STATUSIn development
No SOC 2 or ISO 27001 certification is claimed.
Claims will be updated only after independent work is complete and approved for publication.DEFENSE IN DEPTH
Security across people, product and partners.
Controls will be finalized based on the actual architecture, data flows, regulated partners, risk assessment and independent testing.
Authentication
Multi-factor authentication, secure recovery and session protections appropriate to account and administrative risk.
Access controls
Role-based, least-privilege access with separation of duties, approvals and periodic reviews.
Monitoring
Centralized security logging, alerting, anomaly detection and documented escalation procedures.
Vendor risk
Security and privacy diligence, contract requirements and ongoing review for material providers.
Incident response
A tested process for containment, investigation, recovery, required notices and lessons learned.
Business continuity
Backups, recovery objectives, dependency planning and customer communication procedures.
Secure development
Code review, dependency management, environment separation, testing and vulnerability remediation.
PARTNER BOUNDARIES
Security responsibilities follow the service.
Protects its technology, interfaces, administrative data and integrations.
Protects the brokerage environment, securities custody, execution and its regulated processes.
Protect their authorized users, payroll systems and submitted program data.
Protect credentials, use multi-factor authentication and report suspicious activity.
WHAT WE WILL NOT OVERSTATE
Verification before certification claims.
NOT CLAIMEDSOC 2 certified
No report is represented as complete.
NOT CLAIMEDISO 27001 certified
No certification is represented as complete.
NOT CLAIMEDBank-grade security
Vague comparisons are not a substitute for factual controls.
NOT CLAIMEDCompletely secure
No system can eliminate all risk.
Security publication gate
Before launch, replace generic planned-control language with statements verified against the production architecture, policies, tests, vendor contracts and incident procedures. Establish a monitored security contact and vulnerability-reporting process.