Your trust, earned through transparency not promises
H13 Crypto is an educational crypto trading simulation. No real money is ever at risk.
But we treat security as though every transaction were real — because the habits you
build here should protect you when you trade real markets.
Six Layers HTTPS Everywhere Auto-Pilot Security
● SECURE
✦ FORTRESS · 6 LAYERS OF PROTECTION
● SECURE
✦ FORTRESS · 6 LAYERS
01. One Source of Truth
Before we talk about technology, we need to talk about philosophy — because security at H13
starts with a fundamental design decision. Most platforms scatter your data across multiple
systems. A balance here, a session there, a user record somewhere else. Every point of
separation is a point of vulnerability.
H13 does the opposite. Every piece of user data — your username, your balance, your
transaction history, your learning progress — flows through a single, central system
called the Control Room.
One Place to Secure
Instead of twenty scattered systems, we protect one central source of truth.
One Place to Audit
Every action flows through a single, logged pathway. Nothing escapes the record.
One Place to Protect
This design decision alone eliminates entire categories of security risk.
02. The Six Layers of Security
H13 is protected by six distinct security layers, each designed to stop threats that the
layer above might miss. Here's how they look at a glance:
┌─────────────────────────────────────────────────────────────────────────────┐
│ THE SIX LAYERS OF H13 SECURITY │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ LAYER 1: FIREWALL (iptables) │
│ ├── Blocks ALL external access to ports 5000, 5001, 5999 │
│ ├── Only localhost can reach internal services │
│ └── All external traffic forced through Nginx (HTTPS only) │
│ │
│ LAYER 2: NGINX (Port 443) │
│ ├── HTTPS encryption on every request │
│ ├── Rate limiting to prevent abuse │
│ ├── IP blocking for suspicious activity │
│ └── Only public entry point to the platform │
│ │
│ LAYER 3: API KEY AUTHENTICATION │
│ ├── Every internal request must carry a valid API key │
│ ├── Invalid keys are rejected instantly │
│ └── Keys are rotated and audited │
│ │
│ LAYER 4: SESSION AUTHENTICATION │
│ ├── Secure session cookies (HttpOnly, SameSite) │
│ ├── Automatic session expiry │
│ └── Session validation on every request │
│ │
│ LAYER 5: ROLE-BASED ACCESS CONTROL │
│ ├── Users see user data │
│ ├── Students see student data │
│ ├── Admins see admin data │
│ └── Wrong role = access denied │
│ │
│ LAYER 6: ADMIN DASHBOARD │
│ ├── Admin-only service control │
│ ├── Start / Stop / Restart services │
│ ├── View logs and audit trails │
│ └── Emergency shutdown capability │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
LAYER 01
Firewall — First Line
The digital equivalent of a locked front door. Ports 5000, 5001, and 5999 are completely invisible to the outside world.
No external access to internal services
Every request passes through Nginx (HTTPS only)
Security by design, not by hope
LAYER 02
Nginx & HTTPS
Every request travels over HTTPS. That padlock in your browser means your data is encrypted from your device to our servers.
All data in transit is encrypted
Rate limiting stops flooding attacks
IP blocking for suspicious sources
LAYER 03
API Key Auth
Behind the firewall, every internal request must carry a valid API key. Invalid keys are rejected instantly. No bypass. No exception.
Machine-to-machine trust enforced
Keys rotated and audited
No anonymous internal calls
LAYER 04
Session Auth
Your login creates a secure session stored in an HttpOnly cookie — inaccessible to JavaScript and common browser-based attacks.
Expires automatically after inactivity
Validated on every request
Cannot be shared or spoofed
LAYER 05
Role-Based Access
No user can see or do anything outside their role. A regular user cannot access admin functions. A student cannot see other students' data.
Enforced on every single request
Admins cannot be impersonated
Wrong role = instant denial
LAYER 06
Admin Dashboard
Platform operators manage everything from one place — but only with the admin role. Every action is logged.
Real-time machine status
Start / stop / restart services
Emergency shutdown capability
03. Who Sees What — Role-Based Access
Role
What They See
What They Can Do
User
Their own balance, trades, and history
Trade, learn, chat
Student
Same as User, plus 75% discount
Trade, learn, chat, get student pricing
Admin
All user data, all machines, system logs
Manage platform, heal machines, control services
04. Stripe & Payment Security
We Never Handle Your Card Details
All payments are processed securely through Stripe —
one of the world's leading payment processors, trusted by millions of businesses.
Your payment information never touches our servers.
PCI Level 1 3D Secure Fraud Protection Tokenized Payments
05. Shadow Server & Auto-Pilot Security
Shadow Server
Runs on port 5999. Monitors the main servers, backs up data continuously, and can be promoted to primary if needed.
Auto-Restart
If a service crashes, PM2 restarts it automatically — no human needed.
Auto-Heal
If a machine stops responding, the Control Room heals it automatically.
Auto-Backup
The Shadow Server backs up your data continuously. Nothing is lost.
Auto-Monitor
Every service is monitored every 60 seconds. Around the clock.
Auto-Log
Every action is logged without human intervention. Full audit trail.
06. The Golden Rule — No Exceptions
H13 ENFORCED ARCHITECTURE RULE
"Every machine MUST use the Control Room API.
No exceptions. No hardcoding. No independent data."
What this means for you:
▸ No machine stores your data locally
▸ No machine has its own copy of your balance
▸ No machine can act independently of the Control Room
▸ Every action flows through a single, audited pathway
07. H13 vs. Trading with Real Money
✅ H13 CRYPTO
✓ $31,000 virtual balance
✓ Zero financial risk
✓ Learn by doing
✓ Test any strategy
✓ No API key storage
✓ Complete educational tools
⚠️ REAL EXCHANGE
✗ Your real money at risk
✗ Losses are permanent
✗ Expensive mistakes
✗ API key security required
✗ No guided learning
08. What We Do NOT Do
We Don't Store Card Details
Stripe handles that. We never see or store your payment information.
We Don't Sell Your Data
Ever. To anyone. Your data is for your learning, nothing else.
We Don't Use Data for Ads
No advertising profiles. No third-party marketing. Your data stays yours.
We Don't Skip Security Layers
Every request goes through all six. No shortcuts. No exceptions.
09. What You Can Do to Stay Safe
Strong Password
Use a strong, unique password for your H13 account. Never reuse it elsewhere.
Enable 2FA
Two-Factor Authentication adds a second layer of protection to your login.
Log Out
Always log out when using a shared or public device.
We will never ask for your password. Never share your login with anyone.
Security Is a Partnership
We do our part. You do yours. Together we keep the platform safe.
10. Frequently Asked Questions
No. H13 Crypto never asks for or stores your real exchange API keys. All trading happens with virtual balance inside our secure sandbox.
All payments are processed securely through Stripe. We never see or store your credit card information. Your financial data stays with Stripe, a PCI Level 1 certified processor.
Yes. We use encrypted databases, secure connections (HTTPS/TLS 1.3), and follow industry best practices for data protection. Your email and basic profile are only used for account management.
Your virtual balance is stored in our PostgreSQL database with complete transaction history forever. It's yours to practice with — no real money involved, no withdrawal risk.
Absolutely. We only use your email for account verification, login, and important platform updates. We never sell or share your data with third parties.
Auto-pilot security handles it. Services restart automatically, machines heal themselves, data is backed up continuously, and every action is logged — even when no human is watching.
Ready to Trade Safely?
Start your paper trading journey with enterprise-grade security. No risk. No KYC. Just pure learning.