Security

Ione Tech Ltd builds institutional software for the commodity ecosystem. Security is a design constraint on that software rather than a feature of it: the Platform handles trade records, counterparty data, inventory positions, and settlement instructions, and it is built to protect the confidentiality, integrity, and availability of that information throughout its lifecycle.

This page describes our security posture at a level appropriate for public disclosure. It is not a complete description of our controls, and specific architectural detail is deliberately omitted. Customers, prospective customers, and their auditors can request further information under a non-disclosure agreement using the contact details in section 11.

1.1 Scope. This page covers the IONE TECH platform, its APIs, our corporate systems, and this website. Where the Platform is deployed into a customer's own tenant or infrastructure, responsibility is shared as described in section 10.

2.1 Underlying platform. I-CORE, the institutional ERP backbone of the Platform, is built on Microsoft Dynamics 365 and runs on Microsoft Azure. The Platform therefore inherits the physical, infrastructure, and platform-level security controls that Microsoft operates and maintains, including datacentre physical security, hardware and hypervisor isolation, platform patching, and network-level protections.

2.2 Platform certifications. Microsoft maintains an independently audited compliance programme for Azure and Dynamics 365 that includes, among others, ISO/IEC 27001 for information security management, ISO/IEC 27017 for cloud security controls, ISO/IEC 27018 for protection of personal data in the cloud, and SOC 1, SOC 2, and SOC 3 attestations. These certifications are held by Microsoft in respect of the underlying platform. The authoritative and current list, together with the corresponding audit reports, is published by Microsoft in the Microsoft Trust Center.

2.3 Our own position. IONE has not at this time completed an independent certification or attestation of its own — such as ISO/IEC 27001 certification or a SOC 2 examination — and this page should not be read as claiming one. We state this plainly so that customers can assess our posture accurately. Our controls are described below, and we will update this page if and when an independent audit is completed.

3.1 Data in transit. All connections to the Platform, its APIs, and this website are encrypted using Transport Layer Security. Modern cipher suites are used and legacy protocol versions are disabled. Certificates are issued and renewed automatically, and HTTP Strict Transport Security is enforced so that browsers refuse to connect over an unencrypted channel.

3.2 Data at rest. Data held in the Platform is encrypted at rest using the encryption services provided by the underlying Microsoft platform, including storage service encryption and transparent data encryption for database content, using industry-standard algorithms.

3.3 Key management. Cryptographic keys and application secrets are held in managed key vault services with restricted access, are never committed to source control, and are rotated in line with our internal policy and on any suspicion of compromise.

4.1 Authentication. Access to the Platform and to our corporate systems is authenticated through Microsoft Entra ID. Multi-factor authentication is required for administrative and privileged access.

4.2 Authorisation. Access follows the principle of least privilege: users and services receive the minimum permissions required for their function, granted through role-based access control rather than to individuals directly. Administrative and production access is separated from ordinary user access, and sensitive operations require segregation of duties.

4.3 API access. Platform APIs authenticate every request. Credentials are scoped to the calling client, transmitted only over encrypted connections, and can be revoked immediately. Requests are subject to rate limiting, and limit state is returned to callers in response headers so that integrations can back off cleanly.

4.4 Lifecycle. Access is provisioned on a documented basis, reviewed periodically, and revoked promptly when a person changes role or leaves. Credentials are individual; shared accounts are not used for privileged access.

5.1 Network controls. Platform components are deployed into segmented networks with restrictive ingress and egress rules. Administrative interfaces are not exposed to the public internet. Distributed denial-of-service protection and web application firewalling are provided at the platform edge.

5.2 Application controls. The Platform validates and encodes input, enforces authorisation on every request rather than relying on interface state, and applies defensive controls against common web and API vulnerabilities, including injection, broken access control, and insecure deserialisation.

5.3 Isolation. Customer environments are logically separated so that data belonging to one customer is not accessible to another.

This website enforces the following response headers on every request:

Strict-Transport-Security, with a two-year max-age, subdomain inclusion, and preload — instructing browsers to use HTTPS exclusively for this domain and its subdomains. X-Content-Type-Options: nosniff — preventing browsers from reinterpreting a response as a different content type. X-Frame-Options: DENY — preventing the site from being embedded in a frame, defeating clickjacking. Referrer-Policy: strict-origin-when-cross-origin — limiting how much URL information is disclosed to third-party destinations. Permissions-Policy — denying access to camera, microphone, and geolocation, and disabling interest-cohort tracking.

The website loads no third-party scripts, advertising tags, analytics, or tracking pixels, which removes an entire class of supply-chain and data-leakage risk. Our public tools perform their calculations in your browser rather than transmitting inputs to a server.

7.1 Audit trail. The Platform maintains an audit trail of material actions, recording what changed, who changed it, and when, so that trade lifecycle, inventory, and settlement events can be reconstructed for regulatory and forensic purposes.

7.2 Security monitoring. Infrastructure, application, and identity telemetry is collected centrally and monitored for anomalous behaviour, failed authentication patterns, and configuration drift, using the security monitoring and threat protection services of the underlying platform.

7.3 Log integrity. Security-relevant logs are retained for a defined period and protected against modification and unauthorised access.

8.1 Development practice. Changes are made through version control, reviewed before release, and promoted through separated development, staging, and production environments. Production credentials are not used in development, and production data is not copied into non-production environments.

8.2 Dependency management. Third-party dependencies are monitored for known vulnerabilities and patched promptly, including transitive dependencies. We keep our runtime dependency surface deliberately small.

8.3 Change control. Production changes are traceable to an approved change and can be rolled back. Infrastructure configuration, including the security headers described in section 6, is defined in code and reviewed in the same way as application changes.

9.1 Backup and recovery. Platform data is backed up on a regular schedule, with backups encrypted and retained in accordance with our retention policy. Recovery procedures are documented so that service and data can be restored following a failure.

9.2 Availability. The Platform is deployed on infrastructure providing redundancy at the hardware, availability zone, and regional level, as configured for each deployment.

9.3 Incident response. We maintain an incident response process covering detection, triage, containment, eradication, recovery, and post-incident review. Where an incident affects a customer's data, we notify the affected customer without undue delay and cooperate with their own investigation and notification obligations. Where a personal data breach is likely to result in a risk to individuals, we notify the relevant supervisory authority and affected individuals as required by applicable law, as described in our Privacy Policy.

10.1 Security of the Platform is shared. IONE is responsible for the security of the software it supplies and of the infrastructure it operates. Microsoft is responsible for the security of the underlying cloud platform. The customer is responsible for security within its own environment.

10.2 Customer responsibilities typically include managing its own user accounts, roles, and access reviews; enforcing its own authentication policy, including multi-factor authentication for its users; safeguarding API credentials issued to it; configuring the Platform in accordance with its own regulatory obligations; and securing the endpoints and networks from which its users connect.

10.3 Regulatory responsibility. As stated in our Terms of Service, IONE is a technology provider and is not licensed by the Dubai Financial Services Authority. Where the Platform supports activities that are regulated when performed — trading, custody, lending, payments, or compliance screening — those activities are carried out by the customer under its own licences, and the customer remains responsible for meeting the regulatory requirements applicable to them.

11.1 Reporting. If you believe you have found a security vulnerability in our Platform, APIs, or website, report it to info@ionetech.io with the subject line “Security”. Please include enough detail to reproduce the issue, such as the affected endpoint or page, the steps taken, and any supporting evidence.

11.2 What we ask. Please give us a reasonable opportunity to investigate and remediate before disclosing the issue publicly or to any third party. Please do not access, modify, or delete data belonging to others; do not degrade or disrupt the service, including through denial-of-service or automated high-volume testing; and do not use social engineering, phishing, or physical intrusion against our staff or premises.

11.3 What we commit to. We will acknowledge your report, keep you informed as we investigate, and let you know when the issue is resolved. We will not pursue or support legal action in respect of good-faith research conducted in accordance with this section. We do not currently operate a paid bug bounty programme, but we are glad to credit researchers who wish to be named.

11.4 Machine-readable contact. A security contact file conforming to RFC 9116 is published at /.well-known/security.txt.

For security questions, to request further documentation under a non-disclosure agreement, or to report a vulnerability:

Ione Tech Ltd Commercial Licence No. CL12931 (DIFC Registrar of Companies) Unit IH-00-01-01-OF-01, Level 1, Innovation One Dubai International Financial Centre Dubai, United Arab Emirates Telephone: +971 4 580 9923 Email: info@ionetech.io Website: ionetech.io