Security

Torque manages security through its software development lifecycle. These controls reduce risk, but they do not eliminate it.

• Requirements and risk: Security work begins before implementation. The team identifies account, data, payment, wallet, permission, provider, and trust boundaries. It also records failure and recovery needs as security requirements.
• Design: Designs apply least privilege and define sensitive data and service boundaries. They separate application access from financial, custody, and signing authority.
• Development: Developers follow secure coding standards, use peer review, and add automated tests. Security checks scan code, dependencies, infrastructure definitions, and relevant smart-contract changes. Dependencies are pinned and reviewed.
• Verification and release: Continuous integration runs required quality and security checks. Changes require review and approval before merge and release. A failed required check blocks release. Approved changes use a controlled deployment process.
• Operations: Teams monitor dependencies and reported vulnerabilities. They prioritize patches and remediation based on risk. Incident response and recovery procedures address operational problems. Findings inform later requirements and development work.

Security areas

• User Account Security explains account access, recovery, ownership checks, and role boundaries.
• Payment and Wallet Security explains custody, signing, confirmation, and configurable two-factor authentication.
• Application Security Framework defines the technical security requirements.