Trust Center

Security and privacy at CTX.

How Commodity Trade X LLC protects member data, how our service providers handle it, how we answer legal requests, and how to report a security issue.

How we protect member data

The safeguards in place today

Encrypted in transit and at rest
Every page, API call and file transfer uses HTTPS (TLS). Stored data and files are encrypted at rest by our database and hosting providers.
Access checked on every request
The database checks who is asking on every read and write, so a member sees only their own records and what a counterparty chose to share. Identity documents sit in private storage and are never shown to other members.
Two-factor sign-in
Every member can turn on two-factor sign-in in Settings. Staff and administrator accounts use it.
Card details never reach us
Card payments are handled by our payment processor. CTX never receives or stores card numbers.
Monitored around the clock
An automated security watch runs every hour and alerts our security owner to unusual sign-ins, changes to staff permissions and bursts of signups.
Daily backups
The database is backed up every day, and backups are kept for 7 days.
Vulnerabilities fixed by severity
We scan our software dependencies every month and fix what we find by severity: critical within 2 days, high within 14 days, medium within 60 days.
Your data, your choice
Download all your data or delete your account in Settings. Deletion removes your personal data. Records the law requires us to keep (deal and billing records for 7 years, identity documents for 5 years after closure) stay on a locked, anonymized account and are deleted when the period ends.
AI features
Our AI features send our AI provider only the records of the member who asked, under commercial terms that do not allow training models on them. AI answers are labeled as AI.
Service providers

How service providers handle member data

CTX runs on established service providers. Each gets only the data its job needs, is bound by data processing terms, and is reviewed every year. We tell members by email or in the app at least 30 days before a new provider starts handling member personal data; an urgent change needed to keep the service secure or running is announced as soon as possible. Members can ask for the current list of providers at support@commoditytradex.com. Updated 3 November 2026.

  • Cloud database and file storage
    Data: Member account data and files
    Location: United States
  • Web hosting
    Data: Requests in transit
    Location: United States
  • Payment processing
    Data: Billing contact; card details are held by the payment processor only
    Location: United States
  • Email delivery
    Data: Name, email address, message content
    Location: United States
  • AI model provider
    Data: The request and the asking member's records sent with it
    Location: United States
  • Business email
    Data: Correspondence with members
    Location: United States
  • Developer platform and scheduled jobs
    Data: Member names and email addresses while a scheduled email job runs
    Location: United States
  • Error monitoring
    Data: Error details, member ID, browser information
    Location: United States
  • Bot protection on signup
    Data: IP address and browser signals
    Location: Worldwide network
  • Website analytics
    Data: Cookies and usage data
    Location: United States
Shared responsibility

Who secures what

CTX is a software service built on cloud providers. The providers secure the infrastructure they run, CTX secures the application and how data is handled in it, and each member company secures its own accounts and what it chooses to share.

  • Datacenters and hardware
    Cloud providers: Physical security, hardware, power and networks
    CTX: Chooses independently audited providers and reviews them every year
    Your company: None
  • Hosting and network
    Cloud providers: Network protection, denial-of-service defenses, host patching
    CTX: Encrypted connections only; secure configuration of hosting and server functions
    Your company: Use a current browser on a trusted network
  • Storage and backups
    Cloud providers: Encryption at rest, daily backups, key management
    CTX: Backup schedule, recovery plan and restore tests
    Your company: None
  • Application security
    Cloud providers: None
    CTX: Secure development, access rules on every request, reviews, fixing vulnerabilities by severity
    Your company: Report suspected flaws to us (see below)
  • Accounts and access
    Cloud providers: Sign-in service
    CTX: Two-factor for staff, sign-in monitoring, two-factor offered to every member
    Your company: Protect passwords, turn on two-factor, remove team members who leave
  • What you share
    Cloud providers: None
    CTX: Enforces sharing rules (private by default, visible to the counterparties you choose); screens counterparties against sanctions lists
    Your company: Decide what to post and what to share in deal rooms; check counterparties before trading
  • Payments
    Cloud providers: The payment processor holds card data
    CTX: Never receives card numbers; verifies payment events
    Your company: Keep billing contacts current
  • AI features
    Cloud providers: Our AI provider runs the models under commercial terms
    CTX: Sends only the asking member's records; labels AI output
    Your company: Review AI output before relying on it
  • Incidents
    Cloud providers: Tell CTX about incidents on their side
    CTX: Detect, respond, and notify members and authorities
    Your company: Tell us at once about suspected account misuse
  • Legal and compliance
    Cloud providers: Their own certifications and terms
    CTX: Privacy Policy, sanctions screening, data retention
    Your company: Your own trade, export and sanctions compliance for the deals you make
Law enforcement and government requests

How we answer requests for member data

  1. Requests go to our security owner. Other staff do not answer them.
  2. We disclose member data only when the law requires it: a valid subpoena, court order, warrant or equivalent legal process that applies to CTX, checked by counsel. We refuse informal requests unless there is an emergency risk of death or serious injury.
  3. We disclose the minimum the request requires, and ask for a narrower request when it is too broad.
  4. We tell the affected member before disclosing, so they can object, unless the law forbids it or notice would create an emergency risk. If notice is delayed, we tell the member when the restriction ends.

Every request and our response is recorded. Send legal process to support@commoditytradex.com.

Incidents

If something goes wrong

If a security incident affects your personal data, we tell you without undue delay: what happened, which data, what we have done and what you should do. We notify regulators as the law requires, including within 72 hours where the GDPR or UK GDPR applies.

Report a security issue

Found a vulnerability? Tell us.

Email support@commoditytradex.com with “Security report” in the subject. Tell us what you found, where (the page or feature), the steps to reproduce it and what an attacker could do with it. We acknowledge every report within 3 business days and keep you updated until it is fixed.

Please follow these rules:

  • Test only with accounts you own.
  • Do not access, change or delete other people's data. If you reach someone else's data by accident, stop and tell us.
  • No denial-of-service testing, spam, social engineering or physical attempts.
  • Give us reasonable time to fix the issue before you tell anyone else.

We will not take legal action against anyone who follows these rules in good faith. We do not run a paid bug bounty at this time. Our security.txt file is at /.well-known/security.txt.

Contact

Questions about security or privacy

Commodity Trade X LLC, Florida, United States. Email support@commoditytradex.com. Read our Terms and Privacy Policy.