Security
Effective 15 September 2026. How ALIEN SOFTWARE LLC, a Wyoming limited liability company ("Clobber") protects the Service and the data in it. This page is referenced by the Terms of Service and by the Data Processing Addendum, and the measures described here are the ones we commit to there.
#Report a vulnerability
[email protected]. We acknowledge every report within one business day and we will keep you informed until it is closed. Test only against your own sandbox environment, never against another customer's data or against production traffic, and give us reasonable time to fix an issue before disclosing it. We will not pursue legal action against anyone who reports in good faith within those limits.
#Tenant isolation
Every environment is a separate tenant, and the tenant identifier is the first component of every key in the system: markets, accounts, currencies, idempotency records and rate limit counters. A request authenticated to one tenant is structurally unable to name an object belonging to another, rather than being prevented by a check that could be forgotten. This is covered by adversarial tests written specifically to attempt cross tenant access, and those tests run on every change.
An environment is pinned to one region and one cell at creation and never spans either.
#Authentication and access
API keys are per environment and carry a role: administrative, trading or read only. Keys are stored hashed, are shown once at creation, and can be rotated and revoked at any time. Dashboard access is separate, is per person, and carries its own roles. Every action taken with a credential is attributed to that credential in the journal.
Internal access to production systems is limited to the people who need it, requires multi factor authentication, and is logged. Access is reviewed when someone's role changes.
#Encryption
Traffic to the API, the feed and the dashboard is TLS 1.2 or better, and plaintext connections are refused. Data at rest, including the journal, its archive and the projection database, is encrypted with keys managed by the cloud provider. Secrets are held in a managed secret store, never in the repository, and are write only to the people who set them.
#Durability and integrity
The engine is a deterministic state machine over an append only journal. Every command is made durable before it is applied, and the acknowledgement you receive reflects a command that is already on disk. That design gives three properties that matter for security as much as for reliability:
- The journal is a complete and ordered audit record. Every command, the credential that sent it and the moment it arrived, in the order it took effect.
- State can be reconstructed and verified. Replaying the journal reproduces the state it produced, so a claim about what happened can be checked rather than trusted.
- The ledger is conserved at write time. An internal invariant checker runs after commands and after every snapshot, so an imbalance is caught where it happens rather than found later by reconciliation.
Journals are replicated to durable object storage in the environment's region.
#Software and change management
Changes are reviewed, and the test suite (unit, property, differential against a second independent engine, crash and replay determinism) runs before anything ships. Deployments are staged, verify themselves against the running system afterwards, and roll back automatically if verification fails. Dependencies are kept minimal by design, and are monitored for known vulnerabilities.
#Monitoring and incident response
The Service emits operational logs and metrics continuously, with alerting on availability, latency and error rates. Current availability is published at status.clobberhq.com.
If we become aware of a security incident affecting your data, we notify you without undue delay and in any event within 72 hours, with what happened, what data was involved, what we have done and what you should do. If the facts are still developing we send the notice anyway and update it. Affected customers receive a written post incident summary once the cause is understood.
#Your side of it
Security of your markets depends on things only you control: keep API keys secret and scoped to the least privilege that works, rotate them when someone with access leaves, use separate environments for development and production, and treat your administrative key as the credential that can settle a market, because it is.
#For buyers doing diligence
Enterprise customers receive our security questionnaire responses, architecture documentation, and the details of the isolation and durability testing described above. Independent audit reports and certifications are on the roadmap and are scoped against real customer requirements rather than in the abstract; if you have a specific framework you need, tell us at [email protected] and we will tell you honestly where we stand against it.