Security

Source files require a controlled intake path.

Trade Recovery Data does not request real import/export source files until the paid-screen scope, authorized contact, and secure intake route are confirmed.

Current controls

• Public site uses Cloudflare Pages with security headers.
• HSTS, content security policy, clickjacking protection, content-type protection, referrer policy, and permissions policy are configured at the edge.
• Email authentication is enforced on Trade Recovery Data mail through Google MX, SPF, DMARC, and DKIM.
• Initial form submissions are limited to non-confidential fit information.
• Bot checks are supported through Cloudflare Turnstile when the site key is configured.
• Payment collection follows a confirmed fit call and written scope confirmation.

Above-baseline posture

• Public pages are static by default, reducing application attack surface.
• The site publishes a security contact at /.well-known/security.txt.
• Source-file intake is intentionally separated from the public website.
• Client records require written scope, confirmed authority, controlled transfer, and limited access before analysis starts.

Intake-handling commitments

• No source files before secure-intake instructions are confirmed. The public form is for non-confidential fit information only.
• Source files require a controlled intake path with the confirmed channel, storage location, access owner, and scope recorded before transfer.
• Encrypted transfer is expected for any real import entries, broker exports, invoices, SKU files, BOMs, or shipment records.
• File access should be limited to the confirmed screen owner and any separately confirmed licensed specialist.
• No credentials, portal passwords, shared inbox passwords, or broker-login details should be sent through the public form or ordinary email.

File-handling rule

Do not send source files through open email before receiving confirmed secure-intake instructions. Initial fit checks should discuss only data availability, data owners, source systems, date ranges, and matching keys.

Buyer diligence

For the complete commercial trust stack, review the buyer diligence file. It connects the offer, fixed-fee scope, security posture, delivery controls, and professional boundaries in one page.

Security contact

Report file-handling or security concerns through the intake page or by routing to intake@traderecoverydata.com with no source-file attachments.