Cybersecurity Framework

Automated high-frequency options trading demands an uncompromising, institutional-grade cloud infrastructure. This Cybersecurity Framework Policy details the strict technical guardrails, encryption protocols, and operational mandates implemented by SPIKE Options LLC to safeguard our execution network and your capital.

1. Cryptographic Key Defenses

Your connection to the market is our highest security priority. All API credentials, access parameters, and connection secrets linked to partner firms (including Alpaca, Webull, Tastytrade, Tradier, and TradeStation) are subjected to heavy cryptographic shielding.

• Encryption at Rest: All sensitive database records are encrypted using AES-256 protocols via dedicated hardware Key Management Systems (KMS).
• Encryption in Transit: API payloads, authentication requests, and execution commands are transferred exclusively via TLS 1.3 pipelines during active trade routing routines.
• No-Display Protocol: Once an API key is successfully ingested into the SPIKE dashboard, it is irreversibly hashed. It can never be displayed in plain text again, even to internal SPIKE engineers.

2. System Isolation and Architecture

The SPIKE execution layer and the Oculus AI builder engines operate inside deeply isolated cloud virtualization structures (Virtual Private Clouds). By containerizing the core architecture, we prevent cross-tenant data leakage and contain potential isolated execution errors.

Our entire production environment sits behind an advanced Enterprise Web Application Firewall (WAF) designed to automatically detect and deflect distributed denial-of-service (DDoS) threats, unauthorized access probes, SQL injections, and malicious botnet traffic before it reaches the execution tier.

3. Internal Zero-Trust Access

SPIKE strictly adheres to a Zero-Trust internal security model. No system, script, or employee is implicitly trusted, regardless of their location within our corporate network.

• Principle of Least Privilege: SPIKE engineers and support staff operate with the minimum level of access necessary to perform their roles. No human employee has direct access to user API keys or plain-text billing information.
• Mandatory Authentication: All internal administrative actions require hardware-based Multi-Factor Authentication (MFA) and are immutably logged for routine security auditing.

4. Client Authentication Standards

We provide robust tools to ensure the client-side of the platform remains secure. Users are strongly encouraged to enable Time-Based One-Time Password (TOTP) Multi-Factor Authentication upon initial account creation.

The SPIKE platform employs rigorous session management protocols, including automatic termination of idle dashboard sessions, concurrent login restrictions, and instant alerts for logins attempting to access your account from unrecognized geographical IP locations.

5. Vulnerability Management and Auditing

Our codebase undergoes continuous integration scanning to identify patched vulnerabilities and outdated software dependencies before they ever reach the production environment. We conduct routine automated penetration testing and actively monitor CVE (Common Vulnerabilities and Exposures) databases to deploy emergency hotfixes mitigating zero-day exploits.

6. Incident Response and API Kill-Switch

SPIKE maintains active, 24/7/365 performance monitoring tools across all live routing paths. In the event of a critical threat, we prioritize the protection of client capital above all else.

In the unlikely event of a suspected database or data path compromise, we are legally mandated to alert impacted users via their registered account emails within 72 hours. This notice will detail the specific nature of the event, the data potentially involved, and provide immediate instructions for cycling your brokerage API credentials to fully secure your connected portfolios.