Important notice
This overview describes current security intent and controls at a high level and should not be treated as a certification statement.
1. Secure user authentication
AdvisorOne uses authenticated account access and token-based session flows to protect user accounts and platform actions.
2. Access controls and account separation
Platform access is scoped to authenticated users and account ownership rules. Application logic is designed to separate adviser records and client data by adviser context.
3. Server-side authorisation and database protection
Sensitive operations are enforced server-side. Requests are validated against authenticated user identity before data is read or modified.
4. Encryption in transit and at rest
AdvisorOne expects transport encryption using HTTPS/TLS for data in transit. Underlying managed services typically provide encryption at rest capabilities where enabled by provider defaults and configuration.
[PLACEHOLDER - CONFIRM TECHNICAL CONFIGURATION: Enforced HTTPS policy, certificate management, and current storage encryption settings.]
5. Secure file-storage controls
Document upload and retrieval paths use authenticated access checks and controlled storage references to reduce unauthorised file exposure.
6. Credential and key protection
API keys, service credentials, and environment variables should be managed via secure deployment secret stores and must not be exposed in client-side code.
7. Input validation and file-upload safeguards
AdvisorOne applies request validation and file-upload constraints such as allowed file types and size limits to reduce abuse and malformed input risks.
8. Session and account-security practices
Session controls are tied to authenticated identity, and account-level actions require valid credentials. Advisers should sign out on shared devices and maintain secure endpoint hygiene.
9. Logging, monitoring, and error handling
Operational logs and error handling support service reliability and incident analysis. Sensitive values should not be unnecessarily exposed in client-visible error output.
10. Backups and recovery considerations
Data resilience depends on managed platform capabilities and operational recovery plans.
[PLACEHOLDER - CONFIRM DR PROGRAM: Backup frequency, restore testing cadence, and recovery objectives.]
11. Dependency and platform updates
AdvisorOne updates framework, runtime, and dependency components to address security issues and maintain platform stability.
[PLACEHOLDER - CONFIRM PROCESS: Vulnerability scanning cadence, patch timelines, and critical-update escalation standards.]
12. Secure software development
Security is considered during feature development through code review, validation, least-privilege access patterns, and controlled deployment processes.
13. Incident response and breach notification
Suspected incidents are triaged, investigated, and escalated according to internal response procedures. Where required by law, affected parties and regulators are notified.
14. Adviser responsibilities
Advisers should:
- use strong, unique passwords,
- avoid sharing login credentials,
- secure their devices and browsers,
- report suspicious activity promptly.
15. Responsible disclosure
If you discover a potential security vulnerability or data incident, report it through the Contact page and select Security concern.
[PLACEHOLDER - CONFIRM SECURITY CONTACT: security@advisorone.co.za and incident escalation channel.]