Public evidence
Controls The Trade Talk currently operates, together with the assurance work that has not been completed.
WorkOS AuthKit provides sign-in and session identity. Sensitive Convex functions independently require authenticated accounts and resource authorization.
This is an implementation statement, not a claim that every public and private route uses the same middleware.
Organization, project, order, contract, payment, calendar, brand, and communication operations use membership, ownership, or participant checks in Convex.
Authorization tests cover critical boundaries; this publication does not claim formal certification.
Payment state changes require provider verification. Contract OTP signatures are bound to an exact contract version and evidence record.
The Trade Talk is not an escrow service and does not guarantee provider availability.
No external penetration-test report, SOC 2 report, ISO certificate, or recurring third-party audit is published.
No such assurance should be inferred from product security language.
