Trust and safety
Built to protect what matters.
Your gold, your data, and your money deserve the same level of protection. Here is how we deliver that, in plain language.
All data in transit is protected by TLS 1.3. Data at rest is encrypted with AES-256. Encryption keys are managed by a dedicated key management service with automatic rotation.
Our infrastructure and operational controls are audited annually by an independent third party against the SOC 2 Type II standard for security, availability, and confidentiality.
We do not store card numbers on our servers. All payment data is handled by a PCI DSS Level 1 certified payment processor. Your card details never touch our systems.
Every account is verified at sign-up using a licensed identity verification provider. Documents are checked against government databases and then discarded from our systems after verification.
Access to customer data within AAQ Gold is governed by strict role-based access control. Only the minimum number of staff who need access have it, and all access is logged and audited.
Transactions and account activity are monitored in real time for unusual patterns. Suspicious activity triggers an automatic hold and a human review before any funds or gold move.
Our ongoing practices.
Penetration testing is conducted twice a year by an independent security firm.
Employees undergo security awareness training every six months.
All code changes go through a peer review and automated security scanning before deployment.
We maintain a bug bounty programme for responsible disclosure of security vulnerabilities.
We operate a documented incident response plan with defined escalation paths and customer notification timelines.
Vendor and third-party access is reviewed quarterly and revoked immediately upon contract end.
Responsible disclosure
If you believe you have found a security vulnerability in AAQ Gold, please report it to us at security@aaqgold.com. We ask that you give us reasonable time to investigate and address the issue before any public disclosure. We will acknowledge your report within 24 hours and keep you informed throughout the process.
security@aaqgold.com