MFA on ops seats
Operator logins. Least privilege by role. Support is not a super-admin personality.
Trust
How this stack is hardened.
Marketing site and product are separate. This page is about both. Least privilege is the default, not an enterprise SKU. We do not sell a fake ISO wall.
Posture
Hover a layer. Click to pin. No fake ISO theatre.
View source on this origin. It is boring on purpose.
Two surfaces. Two postures.
This marketing origin ships CSP, referrer policy, nosniff, frame deny, and a permissions policy. No third-party scripts. No analytics pixels. Lead forms stay on this origin. Secrets do not sit in HTML. Image sources are self and data — we do not pull remote brand art at runtime.
The product tenant is isolated. Operator seats use MFA. API keys are tenant-scoped and you rotate them. Every risk and payout edit writes an audit row. Support cannot silently un-breach. Roles see what they are allowed to move. Bulk actions still log.
We integrate KYC vendors and PSPs. Card data does not sit on this marketing origin. PCI stays with the processor. We do not underwrite you. Restricted countries are your list.
Privacy → · Terms → · Support → · API keys →
Honesty. Delayed streams are labeled delayed. We do not invent a sub-50ms SLA or a 99.9% badge.
Export. Traders, fills, affiliates, rule versions. Exit is a feature. Hostage-taking is a smell.
Report a issue. admin@oneprop.shop — operators and researchers. Do not send trader PII to that inbox unless we ask.
Defaults
What is on without an add-on.
Audit on money and risk
Payout hold/approve/reject and rule compiles write a row. Replay is an admin action.
No silent un-breach
A failed account stays failed unless a named role undoes it with a reason.
Keys you rotate
Tenant-scoped API credentials. Sandbox after the demo. Nothing in front-end HTML.
Bring the security questionnaire.
We will answer what we actually do — and decline the theatre.