Compliance & Security
Security controls, privacy, exchange sync limits, and due diligence information.
Compliance & Security Overview
Thrive DeFi, LLC operates Thrive as a market intelligence and journaling platform. We are not a broker, exchange, custodian, or investment adviser. This page summarizes our security posture and regulatory disclosures for due diligence.
Not financial advice
Security Controls
| Exchange API keys | Encrypted at rest. Read-only permissions enforced in UI copy and onboarding. No withdrawal scopes requested. |
| Authentication | Industry-standard sessions. MFA available. Session management via secure tokens. |
| Transport | HTTPS everywhere. HSTS in production. |
| Rate limiting | Redis-backed rate limits on all sensitive API routes. |
| Webhook verification | Payment and identity webhooks signature-verified. |
| Error monitoring | Production error tracking (metadata only, no journal bodies or API keys). |
| AI providers | Third-party AI inference. User data is not used to train public models (see the Privacy Policy, AI Processing). |
| Secrets | Environment variables only. Never committed to source control. |
Data & Privacy
We collect account email, usage analytics, trade journal data you provide, and encrypted exchange credentials. We do not sell personal data. See our Privacy Policy.
| GDPR / UK GDPR / CCPA | Cookie consent on thrive.fi. Self-serve data export and account deletion in Settings. Requests: privacy@thrive.fi. |
| Data residency | US/EU regions per infrastructure configuration. |
| AI processing | User trade data for AI features is isolated per user and is not used to train public models. See the Privacy Policy, AI Processing. |
| Subprocessors | High-level categories published in Trust Center. Full vendor list available under enterprise DPA. |
Exchange Sync
Exchange connections are read-only. Thrive does not hold customer funds, route orders, or publish exchange referral links. You trade on the exchange yourself.
Certifications Roadmap
SOC 2 Type I assessment is on our acquisition-readiness roadmap. Current controls align with SOC 2 Trust Service Criteria for Security and Confidentiality. Enterprise buyers may request our security questionnaire via cs@thrive.fi.
Due Diligence Package
Our public Trust Center includes processor categories, retention schedule, security controls, incident response, and regulatory position. Under NDA, acquirers may also request:
- Revenue / subscriber export
- Verified exchange-sync volume attestation from admin analytics
- Full vendor register and data licensing summary
- IP assignment documentation for Thrive signals and workbench
- SOC 2 readiness summary and security questionnaire (SIG Lite)
Trust Center: Subprocessors · Retention · Security · Enterprise
Contact cs@thrive.fi with subject line "Due diligence request".
