Last updated: May 2026
Security overview
This page explains our posture in plain language. It is not an exhaustive technical specification and does not list every safeguard.
Encryption and transport security
Public endpoints are served over HTTPS so data in transit uses modern TLS encryption. Keep your devices and browsers up to date to benefit.
Authentication
Every account signs in through a managed authentication service. Sign-in tokens only travel over encrypted connections.
Separation between businesses
Each business's records are kept separate at the database level, so one subscriber's account cannot read another subscriber's customers, quotes or invoices.
Monitoring and audit logging
Operationally we use infrastructure and hosted tooling — including deployment provider logs and optional observability stacks — for uptime, diagnostics, and proportionate security reviews. Business-critical audit trails (for example billing or AI-generation metadata retained in our datastore) stay on server-controlled systems; client-side analytics are not relied on as the legal record for disputes or regulator-facing evidence.
Operator and admin access
GeckoSoftware Ltd maintains a small authorised group for uptime, support, billing integrity, abuse response, and platform engineering. Access follows least-privilege norms and evolves as we mature — we do not claim SOC 2, ISO 27001, Cyber Essentials, or equivalent certifications unless and until we publish an explicit attestation elsewhere.
Reporting vulnerabilities
If you discover a credible security issue, email hello@tradeoshq.com with reproducible minimal steps. Allow us reasonable time to remediate.
No unauthorised testing
Please do not perform intrusive scanning, load testing, or penetration testing against production without prior written permission — it can disrupt real customers and may trigger defensive countermeasures.