- Minimization Policy: We have a policy of minimal information collection and will always seek your authorization for any collection scenario;

- Data Sharing Policy: We will never provide any information about you to any person or third party, nor will we use your data for advertising, including retargeting, personalized or interest-based advertising, unless you expressly authorize us to do so;

- Iaas: Bullsmart is hosted on Amazon Web Services(AWS) public cloud services and is based on AWS native cloud solutions;

- SLA 99.9%: We guarantee a monthly service availability of 99.9% to ensure continuous and stable usage for our customers;

- Multi-Availability Zone Architecture: We employ a multi-availability zone architecture to provide services, avoiding single points of failure and offering distributed services and redundant data backups, thereby enhancing system fault tolerance and reliability.

- Automatic Circuit Breaker, rate limiting, degradation and self-healing: With advanced traffic monitoring and control, our services feature automatic circuit breaker, rate limiting, degradation, and self-healing capabilities. They can automatically adjust and recover during system failures or abnormal conditions, ensuring service stability and availability;

- Elastic scaling of services: Based on cloud-native architecture, our services support elastic scaling mechanism to automatically adjust resources according to actual demand to adapt to traffic peaks and load changes, ensuring the scalability and reliability of the system.

- User personal identity verification: OTP or bio-information verification are required for users in critical operations such as changing transaction passwords and forgetting passwords;

- Information collection: We follow a minimal data collection strategy, and in any data collection scenario, we always seek your authorization;

- Data transmission: Data transmission is encrypted using the TLS (Transport Layer Security) protocol to ensure confidentiality and integrity during the transmission process.

- Data signature: all interface interactions employ a signature mechanism to ensure that data is protected from tampering;

- Storage encryption protection: Sensitive data is encrypted using the AES 256 encryption algorithm to ensure confidentiality during the storage process;

- Data disaster recovery: multi-node data redundancy backup strategy is adopted to replicate customer data to multiple nodes and storage devices to ensure data availability and disaster tolerance;

- Data Recovery Plan: We simulate various data disaster scenarios, develop recovery strategies, and conduct regular drills;

- Data accessibility control: We have strict policies and systems in place to control data access and usage, ensuring the principle of minimal data access and usage;

- Having an independent cybersecurity team that conducts manual and automated VA/PT activities using industry-leading products;

- We employ static application security testing and dynamic application security testing into our continuous integration/continuous deployment pipeline;

- We regularly engage third parties and perform professional penetration testing;

- Our app packages are obfuscated and fortified during release to prevent easy reverse engineering by attackers;

- We have strict network access control policy based on role, scenario, data privacy level and other factors;

- We have deployed mature processes in change management that enable us to reliably and securely release fully tested functionality for you with maximum security;

- That we have a well-developed Business Continuity Plan (BCP) and have taken a very proactive stance on incident management in terms of system downtime, security, and network operations centers, information security management systems, in order to respond quickly to any incidents arising from planned or unplanned changes