1. The governing principle
Authentication establishes who is calling. It does not establish whether that caller may reach this record, for this purpose, under the authority in force right now. Authorisation is therefore evaluated per record by B5 Secure™ and the decision is recorded — which is what makes “who saw this and why” an answerable question.
2. What we do
- Encryption in transit and at rest.
- Least privilege by default; access reviewed on a schedule and on personnel change.
- Multi-factor authentication required for privileged access.
- Credentials and keys in managed secret storage — never in source control, client-side code, a support ticket or a log.
- Hosting on Microsoft Azure; region configurable per deployment.
- Decision and change logging sufficient to reconstruct who did what, when, and under what authority.
No system is perfectly secure. We do not claim otherwise, and we do not describe this platform as guaranteed against loss or compromise.
3. What we ask of you
Use a unique password and multi-factor authentication. Do not share credentials or a Passport. Revoke delegated authority you no longer intend to grant — you can do that yourself and it takes effect at the next decision. Treat any unexpected request for your credentials, banking details or signature as suspicious, and tell us.
4. Reporting a vulnerability
Email security@investnow.com. Include the affected surface, steps to reproduce, and what you observed. If the issue exposes data, describe it rather than sending it — do not attach records belonging to anyone else. Please give us a reasonable opportunity to remediate before publishing.
5. Safe harbour
If you make a good-faith effort to comply with this policy we will treat your research as authorised, will not pursue or support a claim against you for it, and will say so if a third party raises one. Good faith means you stop at the first proof, access only data that is yours or clearly synthetic, do not degrade service, do not exfiltrate, and tell us promptly. If you are unsure whether something is in scope, ask first.
6. Scope
In scope: investnow.com and subdomains we operate; authentication and authorisation behaviour; any case where a caller can reach a record it should not reach; privilege escalation, delegation bypass, or defeating an approval gate.
Out of scope: denial of service and load testing; social engineering of our people, customers or vendors; physical access; scanner output with no demonstrated impact; missing hardening headers with no exploitable consequence; and third-party services we do not operate.
7. What we commit to
- Acknowledgement within two business days.
- An initial assessment with a severity view within ten business days.
- Updates until closed, and confirmation when it is.
- Credit if you want it, anonymity if you prefer.
We do not run a paid bounty programme, and we would rather say so than imply one.
8. Fraud
Private markets attract fraud, and a convincing presentation is not evidence of legitimacy. See investor protection for what to check and how to report a suspected scam.
9. Contact
security@investnow.com or Financial Infrastructure, Inc., PO Box 1410, Menlo Park, California 94026-1410.
InvestNow™ is a demonstration and reference experience operated by Financial Infrastructure, Inc.. It is not a broker-dealer, alternative trading system, exchange, investment adviser or transfer agent. It is not accepting accounts and does not currently accept securities orders or offer securities for sale. Nothing on this site is an offer or solicitation of any security, a recommendation, or a suitability determination. Company data and pricing shown are illustrative and labelled as such.