Security
Last updated 29 October 2026. Operated by Mertin Industries Inc., Republic of Panama. This page is a legal summary; the definitive agreement controls.
Security program
The program is operated by Mertin Industries Inc. and is built around least privilege, private data handling, evidence and a disclosure path. This page describes the current deployment, controls reused from the NeoBank, and the gaps that must close before a public launch.
Controls
| Area | Control | Status |
|---|---|---|
| Identity | Server-side sessions, HttpOnly cookies, organization roles | implemented |
| Agent access | Scoped bearer tokens, expiry, revocation, no DUA or payment authority | implemented |
| Uploads | Private staging, screening, quarantine, deletion after failed screening | implemented |
| Audit | Login, attestation, screening, publish, approval, moderation | implemented |
| Data at rest / transit | Encryption in deployment; TLS at the edge; loopback for local | deployment-dependent |
| KYC/KYB and sanctions | Reuse the NeoBank screening program; exchange integration pending | reuse |
| Incident response | Runbook, severity, notification, post-incident review | roadmap |
| Independent audit | SOC 2 / penetration test | roadmap |
Access and data handling
Portal users authenticate by email session; agents use scoped tokens. Production infrastructure access is restricted, logged and reviewed. Raw uploads are not stored in Postgres; they live in private object storage and are served only through controlled delivery paths. Screening reports and manifests are retained as evidence.
Logging and monitoring
The application records audit events for authentication, attestation, screening, publication, approvals and moderation. Production logging will centralize events, set retention, alert on anomalies and restrict access to logs containing identifiers.
Incident response and disclosure
Report a suspected incident to security@mxtktoken.com. Do not include live personal data or credentials. We welcome good-faith research; do not access data that is not yours, degrade the service, or disclose a vulnerability before we have had a reasonable chance to remediate.
A production program will define severity, containment, customer and regulatory notification, and a post-incident review.
Vendors
Hosting, storage, email, payments, identity/sanctions and monitoring vendors are reviewed for security and data-processing terms. The KYC and sanctions program is reused from the NeoBank rather than procured as a second vendor. A production deployment will publish a subprocessor list and review cadence.
Limitations
No service is perfectly secure. The exchange cannot guarantee that a seller's de-identification is correct or that a buyer will comply with the DUA. Screening, manifests and audit reduce risk; they do not eliminate it.
Operator details
Mertin Industries Inc. · SL-55 Building, 31st Floor, Samuel Lewis Ave. & 55 East St., Obarrio, Panama City, Republic of Panama.
Legal: legal@mxtktoken.com · Privacy: privacy@mxtktoken.com · Security: security@mxtktoken.com
MXTK Data ExchangeThe marketplace for licensed, de-identified data. Screening, data use agreements and manifest-verified delivery.