Platform Security Architecture

Understand the security layers used across 6MM trading infrastructure, APIs, SDKs, webhooks, and partner integrations.

6MM security documentation focuses on partner production readiness. The goal is to keep trading infrastructure stable while making responsibility boundaries clear.

Security layers

Layer	Focus
Infrastructure	Network isolation, encrypted service communication, monitoring, and failover.
Trading systems	Deterministic matching, margin checks, risk controls, and abuse prevention.
Integration security	API keys, HMAC signing, webhook signatures, replay protection, and backend-only secrets.
Partner operations	User session validation, asset custody, customer support, and local compliance controls.

Partner responsibilities

Keep API secrets and signing keys out of browsers and mobile apps.
Validate partner user sessions before issuing trading entry credentials.
Implement webhook idempotency and terminal state checks.
Maintain operational logs for account, order, transfer, and webhook flows.

Integration trust boundaries

Boundary	Required control
Browser or app to partner backend	Validate the partner session before issuing any trading credential.
Partner backend to 6MM API	Use scoped credentials, request signing, time synchronization, and protected secret storage.
6MM webhook to partner endpoint	Verify the signature against the raw request body, reject stale or invalid messages, and deduplicate retries.
Trading state to partner records	Reconcile orders, positions, balances, and transfers using durable identifiers and terminal-state checks.

Production verification

Test expired, revoked, and incorrectly scoped credentials.
Test altered webhook bodies, duplicate callbacks, delayed callbacks, and endpoint timeouts.
Confirm that logs redact secrets, access tokens, and sensitive request payloads.
Alert on repeated signature failures, abnormal order activity, reconciliation differences, and connection instability.
Document the owner and response path for credential exposure, webhook failure, and trading incidents.