[SaaS] Horizon Trust Rentals — Automated Ship Leasing & Investor Pool via EVE SSO

Marketplace Services
1

[HORIZON TRUST RENTALS]

The Next Fintech Era of New Eden — Automated Vessel Leasing & Investment Fund

:rocket: LANDING PAGE & PORTAL: Website

Tired of locking your hard-earned liquid capital in expensive hulls? Want to test a specific mining, transport, or combat fit without market tax overhead?

Horizon Trust Rentals officially introduces the first fully automated, web-driven “Lease-on-Demand” platform integrated directly with the secure EVE Online SSO authorization system.

:fire: THE PILOT CHARTER: PREMIUM LEASING TERMS

Every pilot who undergoes our background check gets access to our interactive custom configuration matrix:

  • Weekly Rental Fee: Strictly 10% of the total [Vessel + Fit] market value.
  • Dynamic Collateral: Your security deposit drops from 75% down to 30% as your corporate Trust Rank scales up.
  • Zero Market Taxes: Avoid Jita sell fees. Simply return the vessel via contract, and your security deposit is 100% REFUNDED instantly.
  • Automated Tracking: No manual paperwork. Calendar deadlines, ESI tracking, and contract handovers are managed completely by our web platform.

:gem_stone: REWARDING LOYALTY: TRUST RANK MATRIX

  • RANK 1 (Newbee) ➔ 1+ Active Lease Days | 75% Collateral | Max 150M ISK Hull Limit
  • RANK 2 (Junior) ➔ 3+ Active Lease Days | 60% Collateral | Max 300M ISK Hull Limit
  • RANK 3 (Middle) ➔ 7+ Active Lease Days | 50% Collateral | Max 600M ISK Hull Limit
  • RANK 4 (Major) ➔ 10+ Active Lease Days | 40% Collateral | Max 1.2B ISK Hull Limit
  • RANK 5 (Elite) ➔ 14+ Active Lease Days | 30% Collateral | Max 2.0B ISK Hull Limit

:money_bag: THE INVESTOR HUB: COLLATERALIZED LIQUIDITY POOL

We are expanding our capital presence across The Forge region and invite select venture partners to join our dynamic liquidity engine.

  • Investment Threshold: Minimum 100,000,000 ISK.
  • Expected Passive Yield: 5% to 7% clean interest paid weekly.
  • Payout Schedule: Automatically calculated and transferred directly to your wallet every single Monday.
  • Capital Efficiency: 100% of your funds are dynamically deployed into customized vessel contracts or high-frequency trading. Zero frozen assets, zero dead hulls.

:locked: IRONCLAD OPERATIONAL SECURITIES:

Your invested ISK is heavily guarded by our Forced Insurance Matrix (Silver/Gold/Platinum tiers locked by tenants) combined with upfront client collateral and a mandatory 25% hull-loss compensation rule. In case of ship destruction, 100% of the active asset value is recovered directly back to the pool balance.

“Your capital. Our infrastructure. Shared horizon.”

  • :globe_with_meridians: ACCESS THE PLATFORM: Website
  • :speech_balloon: IN-GAME OFFICE CHANNEL: Join HORIZON TRUST RENTALS
  • :inbox_tray: CORPORATE RELATIONS: Send an Eve-Mail to 13afe
2

HTR PLATFORM TECHNICAL SECURITY AUDIT

The web platform architecture is built on the FastAPI framework in compliance with strict data protection standards and session isolation. Human factor and API vulnerabilities are completely eliminated.

:key: 1. Authentication: Server-Side Sessions (Secure Cookies)

The login flow via the official EVE SSO is fully protected against Login-CSRF and Session Fixation attacks:

1

Login request: The /auth/login route generates a random cryptographic state (32 bytes) and stores it in a signed JWT token inside an httpOnly cookie (ht_oauth_state, TTL: 10 min).

2

Callback verification: The EVE SSO server redirects the pilot to /auth/callback. The backend strictly compares the state from the URL with the signed value from the cookie.

3

Verification: The code is exchanged for official EVE tokens, validated via /oauth/verify, after which the database profile is created or updated.

4

Session issuance: The user receives a session cookie ht_session — a signed JWT with a 30-day validity period.

Cookie Security in Production (DEBUG=false)

✓HttpOnly: Browser JavaScript has no access to cookies. Protection against session theft via XSS attacks.

✓Secure: Cookie transmission is strictly allowed over HTTPS only. Interception over plain traffic is impossible.

✓SameSite=Lax: Reliable protection against cross-site requests (CSRF).

✓Digital signature: Cookies are signed with HMAC/JWT. Forgery without the server secret key is impossible.

:bar_chart: Critically important: All endpoints obtain user data exclusively from the protected cookie via the get_current_user method. There is not a single ?character_id= parameter in authorization routes. Impersonating a character or “pretending” to be someone else’s ID is technically infeasible.

:triangular_ruler: 2. Access Control (RBAC)

Permissions are verified at the platform core level on every endpoint request via FastAPI Depends:

Role Access level
Guest Catalog and reviews view only
Client Ship rental (with strict rank limit enforcement)
Manage Admin panel access, processing client requests (403 for others)
Main manager Rank management, manager assignment, maintenance mode toggle

:locked_with_key: 3. Cryptography & Secret Protection

:locked_with_key:EVE Token Encryption

All access and refresh tokens received from CCP Games are encrypted using encrypt_token/decrypt_token methods with the ENCRYPTION_KEY before being written to the database. Raw tokens are never stored in the DB. Even in the event of a full database dump leak, using player tokens directly is impossible.

:shield:Fail-Fast System (Foolproof Protection)

The SECRET_KEY and ENCRYPTION_KEY must be ≥32 characters long and cannot match the defaults. In production, if weak keys are detected, the application automatically terminates, preventing the launch of a vulnerable service.

:white_check_mark:Current Server Status

SECRET_KEY — 64 hex, ENCRYPTION_KEY — 64 hex, DEBUG=false (Maximum protection).

:globe_with_meridians: 4. CORS (Domain Whitelist)

A strict whitelist of allowed origins (allow_origins) is hardcoded on the server:

allow_origins = [localhost:3000, horizontrustrentals.online, www.horizontrustrentals.online]
allow_credentials = true

:cross_mark: Result: Any third-party, phishing, or malicious domains are physically unable to send requests with cookies on behalf of our users.

3

ESI-SCOPE MANIFEST (6 SCOPES): HOW HORIZON TRUST RENTALS USES DATA

Our platform operates on the principle of 100% automation. We do not ask for screenshots, do not take your word for it, and do not check contracts manually. For this, upon login via EVE SSO, the system requests only 6 permissions (scopes).

:key: TECHNICAL FOUNDATION: HOW TOKENS ARE STORED

Access Token (20 minutes)

Temporary key that the software inserts into request headers to check the current rental status.

Refresh Token (Non-expiring)

Needed for the website to refresh the session in the background. You do not need to re-login every day — the system tracks deadlines on its own while you are offline.

Encryption

All tokens are irreversibly encrypted in the database using the Fernet algorithm (AES) with a secret ENCRYPTION_KEY. Even a database administrator will not see raw tokens.

:triangular_ruler: SCOPE BREAKDOWN: 6 PERMISSIONS — WHAT WE SEE AND WHY

1. Contracts (esi-contracts.read_character_contracts.v1)

The system automatically finds your in-game contract in Jita 4-4. It verifies the item composition (correct ship and fitting), confirms issuance, and closes the rental when you return the hull. This eliminates errors.

2. Notifications (esi-characters.read_notifications.v1)

Automatic insurance confirmation. You buy insurance (Gold/Platinum) in the game client, CCP Games sends a system signal, our backend sees it and activates the rental. No screenshots to the manager.

3. Wallet Journal (esi-wallet.read_character_wallet.v1)

Payment confirmation. There are no receipts in EVE, so the software checks the fact of ISK transfer via the manager’s wallet journal. This is also needed for the “Affordable” filter in the catalog, so the software does not offer you ships whose deposit you cannot afford.

4. Killmails (esi-killmails.read_killmails.v1)

Direct calculation of your Credit Score. We need to filter out suicide-gankers and professional Jita scammers. Kills in low/null-sec raise the activity rating, while high-sec ganks harshly reduce it.

5. Skills (esi-skills.read_skills.v1)

Protection against throwaway accounts. A character with 1M SP (a week old) will not get an expensive ship because the risk of theft is too high. High SP indicates an old, reliable account and an automatic boost to your Trust Rank.

6. UI (esi-ui.open_window.v1)

Comfort. When clicking the “Open Contract” button on the website, the required window automatically pops up in your running game. You do not have to search manually.

:balance_scale: SUMMARY: STRICT HTR SECURITY RULES

Scam protection

Each scope covers exactly one automation feature. Everything that would have to be proven with screenshots in Discord without the API, our software does in 1 second.