Security.

1. Our approach

Participants share commercially sensitive information, so security is a design requirement of the platform. This page describes our approach and the current state of the website honestly; it is not a certification claim.

2. The website today

• Static front end. The website is built from static HTML, CSS and JavaScript with no server side code to compromise.
• No secrets in the browser. Only public, low privilege configuration is ever placed in front end files. Administrative or service credentials are never included.
• No tracking scripts. We do not load analytics or advertising trackers.
• Verification documents. In the demos, file contents are never uploaded or stored; only the file name and size are kept in your browser. In production, documents are intended to be kept in private storage with access limited to authorised reviewers.
• Demo mode is clearly separated. Demo accounts and data are stored only in your browser and are labelled as not secure.

3. Production services

When production authentication is enabled it is provided by a managed authentication service. Passwords are handled and hashed by that service and never stored in plain text by MINEX. The database schema uses row level security so that participants can only read and modify data they are entitled to: for example, buyers see their own enquiries, and producers manage their own listings and replies.

4. Hosting and transport

The website should be served over HTTPS. We recommend a hosting provider that enforces HTTPS, supports security headers, and provides DDoS protection.

5. What you can do

• Use a long, unique password and a password manager.
• Never share your credentials, and sign out on shared devices.
• Treat unexpected requests for payment or bank detail changes with caution. MINEX never asks you to pay or send funds through the platform.
• Perform your own checks on counterparties.

6. Report a vulnerability

If you believe you have found a security issue, please email hello@minex.technology with the subject “Security”. Include steps to reproduce and any relevant details. Please give us reasonable time to investigate before public disclosure, do not access or modify other people’s data, and do not run denial of service or social engineering tests. We will acknowledge reports and work in good faith to resolve valid issues.