Loading content...
Loading...
Loading...
Your Protection Is Our Priority
Transparent, verifiable security practices
At EconChangers, security is not a marketing claim — it is a set of specific, auditable practices. This page describes exactly how we protect your data, your identity, and your investments. We believe you deserve to know the details.
All data transmitted between your browser and our servers is encrypted using TLS 1.3, the latest transport layer security protocol. This prevents eavesdropping and tampering during transmission.
Your data is stored in databases with provider-managed encryption at rest. Our infrastructure partner encrypts stored data to ensure it remains protected even in storage.
API keys, credentials, and sensitive configuration are stored in encrypted environment secrets, never in source code. Access is restricted by environment (development, production).
FlockTank uses OAuth 2.0 / OpenID Connect via EconChangers as the sole identity provider. Your credentials are managed by EconChangers — FlockTank never stores passwords. This centralized approach means one secure account across all EconChangers properties.
EconChangers supports multi-factor authentication including time-based one-time passwords (TOTP), passkeys, and recovery codes. MFA adds a critical second layer of protection to your account.
Access to features and data is governed by your role (investor, entrepreneur, business owner, expert, admin). Each role has specific permissions, ensuring you only access what is appropriate for your account type.
Sessions are managed with secure, httpOnly cookies. Active sessions are monitored in real time, and revocation propagates instantly via back-channel logout. Single sign-out ensures logging out of any EconChangers property ends your session everywhere. You can view and revoke active sessions through EconChangers.
FlockTank delegates all authentication to EconChangers using industry-standard protocols. Below is a summary of how our authentication system works for transparency and security evaluator reference.
FlockTank operates under the shared econchangers.com parent domain, so all OAuth and SSO flows are same-site — eliminating cross-site cookie issues across browsers. Cross-origin requests are restricted to known EconChangers domains, and API endpoints do not accept credentials from unauthorized origins.
Responses include Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers to protect against common web vulnerabilities.
API endpoints are protected by multi-layer rate limiting to prevent abuse, brute-force attacks, and denial-of-service attempts. Limits are enforced per-IP and per-user.
Key forms and sensitive actions use Cloudflare Turnstile, a privacy-preserving challenge platform that helps prevent automated abuse without intrusive CAPTCHAs.
Uploaded files undergo validation including type checking, size limits, and content verification to help prevent malicious file uploads.
User input is validated server-side using Zod schemas before processing. This helps prevent injection attacks, data corruption, and supports data integrity across the application.
Development and production environments use separate databases, OAuth client credentials, API keys, and webhook endpoints. Demo environments cannot trigger real financial workflows such as KYC verification, escrow transactions, or payment processing.
FlockTank operates under SEC Regulation Crowdfunding (Reg CF). Investment limits are enforced server-side based on investor income and net worth, ensuring full regulatory compliance.
Sensitive operations — including authentication events, investment actions, campaign changes, and administrative actions — are logged with timestamps, user identifiers, and contextual details for compliance and forensic purposes.
Investor and business identity verification is conducted through our certified third-party partner. Documents are processed by the verification provider — FlockTank minimizes direct handling of sensitive identity documents.
Investment records and related compliance data are retained per SEC requirements. Our privacy policy details retention periods and your rights regarding your personal data.
We maintain a defined incident response process to quickly identify, contain, and remediate security events. Here is what you can expect from us if an incident occurs.
Maximum time to notify affected users after a confirmed data breach
Maximum time to acknowledge a reported security vulnerability
Maximum business days to provide an initial assessment of a reported issue
We take security vulnerabilities seriously. If you discover a potential security issue, we encourage you to report it responsibly. We appreciate your help in keeping our platform and users safe.
Authentication and authorization flaws, data exposure, injection vulnerabilities, cross-site scripting (XSS), cross-site request forgery (CSRF), server-side request forgery (SSRF), and any issue that could compromise user data or platform integrity across flocktank.econchangers.com and related EconChangers properties.
We use automated vulnerability scanning to monitor our software dependencies for known security issues. Critical vulnerabilities are patched promptly.
Our codebase undergoes regular security reviews covering authentication flows, data handling, API security, and infrastructure configuration.
We support responsible security research. Our vulnerability disclosure program welcomes reports from the security community with commitments to acknowledgment, assessment timelines, and safe harbor protections.
If you have questions about our security practices or want to report a concern, we are here to help.