DPMINDS TRUST CENTRE · PUBLICPublic assurance.
Public assurance.
Private controls.
This centre gives customers and reviewers useful evidence about how DPMINDS protects its services. Credentials, exploit paths, customer data, internal thresholds and administrative control surfaces remain private by design.
Controls designed around evidence and restraint
DPMINDS publishes the principles customers can assess while keeping operational details that could weaken security restricted.
Minimum necessary access
Administrative access is separated from customer access. Sensitive actions require authenticated, role-controlled paths and are recorded for review.
Fail-closed decisions
When required evidence is missing, stale or inconsistent, protected learning, intelligence and release controls are designed to hold rather than assume safety.
Controlled releases
Production changes are versioned, integrity checked and deployed through a controlled release path with retained rollback evidence.
Evidence without secret leakage
Operational records preserve decision and integrity evidence while excluding passwords, tokens, customer secrets and unnecessary exception content.
Data minimisation
DPMINDS limits personal data to what is needed for identity, payment, licensing, learning, support, security and lawful service measurement.
Human accountability
Automated signals may block or prioritise work, but material customer, security and policy decisions remain attributable to authorised people.
Useful status, without invented uptime
DPMINDS does not currently publish or promise a contractual uptime percentage. We will not turn an unmeasured number into a marketing claim.
This page reports confirmed customer-impacting incidents. Security-sensitive details may be withheld where publishing them could increase risk.
How material incidents are handled
- Detect and containProtect customers and preserve evidence first.
- Assess impactConfirm affected services, data and obligations.
- CommunicatePublish useful customer impact and actions without exposing attack paths.
- Learn and improveRecord corrective actions and publish a safe summary when appropriate.
Notification principle: where an incident materially affects customers, DPMINDS will use this centre and direct customer communications as appropriate. Regulatory notifications are assessed under applicable law.
Continue learning without weakening the record
My DPMINDS uses one verified Academy record across the website and iOS, with proportionate controls for offline continuity, assessment integrity and protected lesson content.
The latest server-accepted position is shared across web and iOS. A lesson accepted at 50% on the website remains at 50% after iOS sign-in.
A renewable server lease refuses learner access from the other channel. A normal close releases immediately; interrupted access clears automatically after 90 seconds.
Eligible offline work is encrypted and queued. Identity, entitlement, chronology and completion rules are checked before the server awards credit.
The current iOS release uses streaming-only lesson delivery and learner-specific watermarking; it does not claim to block screenshots or recording. No software can stop an external camera filming a screen.
The current release does not collect screenshot-attempt events. DPMINDS does not continuously monitor a learner's camera or microphone, and material action requires authorised human review.
Live learning: Enrolment and trainer readiness control access. The preparation register is private to trainers and administrators. Camera, microphone and screen sharing require the relevant device permissions; a countdown does not grant permission. Read the live learning guide →
Assessment integrity: DPMINDS verifies quizzes, examinations, learning credit and certificates against the protected Academy record. Academy Support may release a locked session, and every intervention is recorded. A device alone cannot award completion or a certificate.
Clear product and connection boundaries
Core and Edge remain licensed software products. The retired MT4 website market-data bridge is separate from Core activation, licence verification and support. MT5 supplies the website intelligence feed.
The website feed does not place trades. Execution features in installed software depend on the licensed product and permissions you enable in your terminal.
Core and Edge Windows installers show the approved software terms before installation. Acceptance starts unchecked; you can save or print the terms, or decline and exit. Accepting the terms does not enable trading or give marketing consent.
Secure installer authorisation uses entitlement information and device and network hashes. These serve licensing and security purposes, separately from optional marketing.
Privacy is an operating constraint
ICO registration: ZC237952. Registered 3 September 2026; certificate expires 2 September 2027. Download ICO registration certificate (PDF). Registration is not a certification of GDPR compliance or a product endorsement.
We minimise collection, separate optional measurement from essential service functions, and explain how account, learning-progress and security-event data support the protected service.
Use the minimum information needed to secure accounts, synchronise learning, fulfil services, support customers and meet legal obligations.
Sell personal data, store full card details, collect broker passwords, use profile photos for facial recognition or continuously monitor a learner's camera or microphone.
Review choices, exercise eligible UK data rights and ask for review of a disputed learning-credit or capture-security decision.
DPMINDS-operated activity can be excluded from public visitor counts without storing the originating network address in the visitor record.
News, learning resources and market context in My DPMINDS require an authorised publisher, a reviewed preview and a fixed expiry. Administrators may address a post to verified member accounts; approved trainers may address one only to active Academy learners. Visible PDF pages are recognised in the publisher's browser, checked by that person and rebuilt as a professional landscape report. Market-opportunity reports require confirmed symbol, timeframe, market time, entry, stop-loss and 1R/2R/3R profit targets. PNG, JPG, JPEG and GIF screenshots are first converted locally into a one-page PDF source and then follow the same review. The member's protected PDF contains the reviewed report followed by the original source pages as an audit evidence appendix. Reading and printing require the viewer's active eligible account. Online access expires automatically; a printed or locally saved copy cannot be withdrawn automatically. A restricted audit snapshot and integrity hashes preserve accountability. The Principal alone may dispose of an archive after confirming the action and reason, while a minimal non-content disposal record remains.
Principal and delegated administrators can see current verified My DPMINDS users, session duration and recent login, sign-out or automatic-timeout evidence. A visible protected page renews a short heartbeat; interrupted sessions time out after 90 seconds. The register does not collect IP addresses, passwords, authentication tokens, device fingerprints or precise locations.
Report security concerns safely
If you believe you have found a vulnerability, contact DPMINDS privately before publishing it or testing beyond what is necessary to describe the concern.
Include
- the affected page, service or product;
- clear, reproducible steps and observed impact;
- only the minimum redacted evidence needed; and
- a safe way to contact you.
Boundaries
- do not disrupt services, deceive people or access another person’s data;
- stop testing if sensitive data is encountered;
- do not demand payment or use a finding to threaten disclosure; and
- allow reasonable time for validation and remediation.
DPMINDS does not currently operate a public bug-bounty programme or grant blanket authorisation for penetration testing. Good-faith reports made within these boundaries will be reviewed and prioritised according to risk.
Material external services, named plainly
This public summary identifies material providers that may receive data. The legal role depends on the service and contract; payment and platform providers may act as independent controllers.
| Provider | Purpose | Data in scope | Position |
|---|---|---|---|
| OpenAI Sites and Cloudflare | Web hosting, managed compute, storage, availability and security | Site, account and operational service data where applicable | Service infrastructure |
| Supabase | Customer authentication and account security | Account identifiers, authentication and security data | Service provider |
| Postmark | Transactional email and delivery events | Recipient, message content and delivery metadata | Service provider |
| YouTube and Google | Protected Academy video and audio delivery where enabled | Playback request, service and device data needed to deliver selected content | May act as a separate controller for some services |
| Daily | Private live audio, video and screen-sharing rooms when enabled | Participant and room data; media intentionally shared in a room | Service provider |
| Voipfone | Business telephony and call routing | Telephone network and call-routing records | Service provider |
| Stripe and PayPal | Hosted payment, fraud-control and refund services | Checkout, payer and transaction data | May act as a separate controller for some services |
| Apple | Sign in with Apple, iOS distribution and Apple-managed purchases where used | Apple account, app and purchase data | May act as a separate controller |
Register reviewed 29 August 2026. DPMINDS assesses necessity, access, security and transfer safeguards as applicable. See the privacy declaration for the controlling public privacy notice and the Mobile Academy policy for protected-learning rules.
No badges before evidence
Legal obligations, good-practice frameworks and independent certifications are different things. DPMINDS labels them separately.
Privacy obligations and risk-based controls; not a certification.
Identified as a future independent assurance milestone; certification has not been represented as underway or achieved.
DPMINDS does not claim ISO 27001 certification.
DPMINDS does not currently publish a SOC 2 report.
Material changes, without exposing attack paths
We publish changes that affect customer assurance, security or public commitments. Routine maintenance may not appear here.
MOBILE ACADEMY · POLICY v1.2
No customer actionApple review and lesson-delivery controls aligned
Clarified current screenshot and recording limitations, retained streaming-only delivery and learner watermarking, and aligned mobile progress evidence with the reviewed iOS release.
MOBILE ACADEMY · POLICY v1.1
Automatic controlSingle-channel assessment integrity enforced
Added website-or-iOS session protection, automatic recovery from interrupted sessions, protected assessment checks and recorded Academy Support intervention.
MOBILE ACADEMY · POLICY v1.0
No customer actionMobile learning assurance aligned
Published cross-device progress continuity, controlled offline updates, verified assessments and certificates, recording limitations, provider transparency and human-review safeguards.
PUBLIC TRUST
No customer actionTrust Centre published
Added public security principles, availability and incident position, responsible disclosure, material provider register, assurance status and security-focused release notes.
CONTROL ASSURANCE · ENGINE 2.0.4
No customer actionSelf-forensic integrity recovery completed
Completed a controlled in-place upgrade, preserved concurrent ledger evidence, verified the installed release and restored accepted report delivery.