Security

This page is a placeholder. Global Bridge operates across Iran, Iraq, Afghanistan and Turkmenistan and involves escrow-based fund handling — before this document is published as binding, it must be drafted and reviewed by qualified legal counsel familiar with the currency-exchange and financial-services regulations of each of those jurisdictions.

Concretely, today the platform:

Hashes every password with bcrypt and issues signed JWTs for session authentication.
Generates escrow-release and verification codes with HMAC-based signing, not plain random strings.
Requires a human administrator to review and approve identity documents before an account can trade.
Enforces role- and ownership-based access control on every API endpoint, not just in the UI.
Stores uploaded documents privately, accessible only to their owner and the platform administrator.

Formal third-party security audits and compliance certifications have not yet been completed — treat this page as a description of current engineering practice, not a certified compliance statement.