What's actually implemented — not a marketing checklist.
Where something isn't done yet, it's listed as a roadmap item below — not implied as already in place.
What's built today
Password storage
bcrypt, cost factor 10 — never plaintext, never reversible.
Session security
HttpOnly, SameSite cookies; sessions are DB-backed and expire server-side, not just client-side.
Field-level encryption
IBAN and TRN are encrypted at rest (AES-256-GCM), not stored as plain text alongside the rest of a profile.
Role-based access, server-enforced
Every mutating route checks role and account status in the API — never a UI-only restriction a client could bypass.
Append-only audit trail
Every award, escrow action, verification, and dispute decision is written to a log that database triggers hard-block from being edited or deleted, even by us.
Rate limiting
Every API route is throttled per address, with tighter limits on authentication and job-posting/bidding endpoints.
Security headers
Content-Security-Policy, X-Frame-Options, and related headers on every response.
Multi-seat access control
Company accounts can scope employee access to Operations, Finance, or read-only — not one shared login and password.
Roadmap — not yet complete
- Independent third-party penetration test
- SOC 2 Type II readiness assessment
- ISO 27001 readiness assessment
- Public responsible-disclosure / bug bounty program
Report a vulnerability
Found a security issue? Email security@loadbyton.ae — replace with a monitored inbox before this goes live; this address is a placeholder shipped with the page, not yet an active mailbox.