Security at GoChiHQ

Last updated: November 5, 2026. Operated by GoChiHQ — Ontario sole proprietorship (BIN 1001793631), Kitchener, Ontario, Canada. This page states — plainly, and only where we have evidence — how GoChiHQ protects its website, the GoChi-Trade platform and client data. It sits alongside the privacy policy and the data processing agreement. If a claim is not on this page, we are not making it.

Where things stand, honestly

gochihq.com is live. GoChi-Trade is in pre-launch: it does not take paying customers until its pre-launch gate closes, and one item of that gate is an independent third-party security review (see “Penetration testing” below). The controls described here are the ones in place and tested today — where a control switches on at deployment, this page says so rather than claiming it early.

Encryption

• In transit: this site is delivered through Cloudflare with TLS 1.3 and HSTS (max-age=31536000; includeSubDomains; preload) — verified live from the outside on November 4, 2026. Traffic between our applications and our database provider is HTTPS.
• At rest: database and storage encryption at rest is managed by our platform provider, Supabase.
• Card data: none ever touches GoChiHQ. Payments run on Stripe-hosted pages or partner stores’ own checkouts — no form on this site collects card numbers, and no GoChiHQ code stores, processes or transmits card data (see also the legal hub).

Access control and tenant isolation

• Identity on every request. Accounts run on Supabase Auth, and identity is resolved server-side from the session on every protected request — never from a login-time claim and never from a user id a caller supplies.
• Tenants are isolated by database policy (row-level security on every table), and the isolation is tested, not assumed: an automated suite of 37 checks executes our real production schema against a real database and attacks it — cross-tenant reads, writes, deletes and privilege escalation. The suite caught a real flaw before launch; it was fixed and is regression-tested. The same suite runs against the hosted project before the first paying customer.
• Privileged access fails closed. Owner endpoints deny access when their key is unconfigured, compare keys in constant time, and throttle failed attempts (10 per IP per 5 minutes, then HTTP 429) — a control added after our own brute-force test exposed unthrottled guessing on November 4, 2026, and retested the same day.
• MFA: opt-in TOTP multi-factor authentication is available on accounts. Sign-ins are recorded (IP, country, device) so account holders can spot access they don’t recognise; anomalies are logged for human review.

How we audit — before anyone asks us to

• Internal security audit, November 4, 2026 — a structured audit of the platform (an OWASP Top 10 pass, threat notes, and a data inventory), followed the same day by a brute-force resistance phase. Nine findings: five fixed in the pass, the rest filed with severities and dates.
• Pre-launch security checklist — ten controls (authentication, encryption, sessions, error handling, rate limiting, input validation, logging, backup, monitoring, dependency scanning); a control only counts as done when a test or live check proved it.
• Dependency scanning — on November 4, 2026 every locked dependency of our codebases (221 installs, 114 unique packages) was checked against the OSV / GitHub Advisory vulnerability database: zero known vulnerabilities. The scan repeats monthly.
• Error discipline — our APIs answer failures in one uniform shape with no stack traces or provider internals; logs are deliberately secret-clean (no emails, keys, tokens or request bodies are ever logged).

Penetration testing — the honest status

An independent penetration test has not been performed yet, and nothing on this page should be read as claiming one. What is true today: the internal audits above are complete, and an independent third-party security review is a scheduled pre-launch gate — GoChi-Trade does not take its first paying customer until it is commissioned and its critical findings are remediated. Its scope is already set: authentication and session handling, the tenant-isolation policy set, the owner gate, and payment-adjacent surfaces. When it is done, this page will say so, with the date.

Incident response

A written incident runbook exists — written before launch, on purpose. It sets the order of operations (notify the owner immediately; revoke keys in a fixed order; preserve logs before anything is rotated; diagnose, fix, and write the incident up within 48 hours) and a separate playbook for traffic floods. For personal data we process for clients, we notify the client without undue delay after becoming aware of a breach (data processing agreement, §8). Where Canada’s PIPEDA applies, we keep breach records and report to the Privacy Commissioner — and notify affected people — where there is a real risk of significant harm.

Monitoring and backups

• This website is watched by an automated health check every 6 hours (every public route plus its content). The platform exposes a health endpoint that reports liveness and configuration booleans only — never secrets.
• Backups, stated plainly: our database provider’s free tier offers no point-in-time recovery and no self-serve restore, so the pre-launch gate requires — before the first paying customer — either a backup tier with a rehearsed restore or a scheduled export routine with a recorded restore drill. A backup that has never been restored is a hope, not a backup; the gate treats it that way.

Sub-processors

A short list, each handling only what its job needs: Cloudflare (hosting & delivery), Stripe (payments, on Stripe-hosted pages), Supabase (accounts & database), Web3Forms (form relay to our inbox), our email providers, file-transfer/storage services used for client production files, and Fourthwall and Zazzle for merchandise orders (they are the sellers of record there). The full record is §5 of the data processing agreement; changes are posted there.

What we do not claim

GoChiHQ holds no SOC 2, ISO 27001 or similar certification, and this page lists no audit “layers”, scores or badges. What we offer instead at this stage is the evidence itself: dated audit work, an automated isolation suite you can ask us about, the contractual protections in our client services terms and data processing agreement, and this page — updated when the facts change.

Security questions, the questionnaire pack, and reporting a problem

Doing vendor due diligence on us? We keep a pre-answered security questionnaire pack — the standard procurement questions (encryption, access control, tenant isolation, vulnerability management, incident response, backups, sub-processors, privacy posture), each answer sourced from the dated documents behind this page. Request it via the contact page or at hello@gochihq.com and we will send the current version.

Think you’ve found a vulnerability? Please tell us first, at hello@gochihq.com, before disclosing it publicly — we read every report and we fix what’s real. Product support: support@gochihq.com · +1 519-731-1860.