Skip to main content
Legal & Compliance

Information Security Policy

Last Updated: June 17, 2026

ISO 27001 & ISO 9001 Certified

CMART is ISO 27001 (Information Security Management) and ISO 9001 (Quality Management) certified. We maintain a robust and compliant Information Security Management System (ISMS) to ensure the confidentiality, integrity and availability of all data entrusted to us by our energy trading clients.

1. Infrastructure & Platform Security

All of our accelerator platforms (ACCORD™, XCAP™, VOICE™) are designed with a security-first, cloud-native architecture:

Network Architecture

Deployments reside in private Azure Virtual Networks (Vnets) with Application Gateways, private DNS zones and network security groups (NSGs) restricting access strictly to authorized endpoints.

Encryption Standards

All trade data, documentation and connection packets are encrypted in transit using TLS 1.3 and at rest using AES-256 standards with client-managed keys where applicable.

2. Authentication & Secrets Governance

  • Access Controls: We support OAuth 2.0 / OpenID Connect configurations via enterprise systems (such as Keycloak, Azure AD/Entra ID). Users log in via Single Sign-On (SSO) with Multi-Factor Authentication (MFA) enabled.
  • Secrets Management: All operational API tokens, exchange connection keys, database passwords and mail server credentials are encrypted and stored in Azure Key Vault or AWS Secrets Manager. Secrets are never hardcoded in source repositories.
  • Role-Based Access Control (RBAC): Granular permissions ensure that only authorized middle-office or back-office managers can approve deal mappings or exception releases.

3. Software Development Security

We employ strict Secure Software Development Life Cycle (S-SDLC) practices in our engineering centers:

  • Code Reviews: Mandatory dual-review pipelines on all code modifications before merging to main branches.
  • Vulnerability Scanning: Automated code scanning tools (SonarQube) and OWASP dependency checks are integrated directly into our Azure DevOps CI/CD pipelines to intercept risks before deployment.
  • Audit Logging: All changes made within the accelerators are logged with immutable, time-stamped records showing user IDs, actions and source IP addresses.

4. Incident Response & Monitoring

We monitor application integrity and server clusters 24/7 using enterprise observability tools (Zabbix, Grafana, Prometheus, Azure Monitor). In the event of a security anomaly or platform failure, our Incident Response Team is notified instantly via automated alert and triage pipelines. We operate under strict service level agreements (SLAs) to guarantee rapid response, containment and notification protocols.