Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The SEC allows for individuals to not register with them if they don't permit business with users outside of the state:

A broker-dealer that conducts all of its business in one state does not have to register with the SEC. (State registration is another matter. See Part III, below.) The exception provided for intrastate broker-dealer activity is very narrow. To qualify, all aspects of all transactions must be done within the borders of one state. This means that, without SEC registration, a broker-dealer cannot participate in any transaction executed on a national securities exchange or Nasdaq. Also, information posted on the Internet that is accessible by persons in another state would be considered an interstate offer of securities or investment services that would require Federal broker-dealer registration.

What technology or implementation is sufficient to protect a website and limit its access to a given state?

share|improve this question

closed as off topic by Antony Vennard, AJ Henderson, lynks, Luc, LamonteCristo Apr 8 '13 at 10:50

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

As far as I'm aware, virtually anything you do using phone lines or the Internet constitutes interstate commerce in the United States. Congress and the Department of Justice have taken this position to ensure they can get their fingers into anything they decide they want to regulate or prosecute. I really think you need a legal definition, and not a technical definition. – Xander Apr 4 '13 at 0:58

A private network using leased lines or private VPN's may be sufficient enough for this. I guess there would need to be the adequate paper work to show that your end-users are all within the same state that you are doing business and you are doing due diligence to ensure that is correct.

But yeah, a private VPN would ensure random users from other states do not access your services?

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.