Security practices

Credentials & secrets

Broker API keys, database credentials and other secrets are never hard-coded or committed to source control. They are managed through environment variables and a secure secret-management system (such as AWS Secrets Manager), and broker secrets are never exposed to browser-side code.

Encryption

All traffic is served over HTTPS/TLS. Sensitive data is protected at rest using the security controls of the underlying managed database and storage services.

Authentication & authorization

• Secure password hashing and session/token protection
• Server-side authorization checks on every trading action — never enforced only in the frontend
• Rate limiting and input validation/sanitization on all user input
• Parameterized queries / ORM protections against SQL injection

Monitoring & audit logging

Authentication events, account changes, strategy changes, broker connections and trading actions are recorded to an audit log. Application monitoring and error logging are configured to avoid leaking secrets or sensitive user information.

Safe failure states

If a broker API, market-data provider or internal service becomes unavailable, the platform is designed to stop new trading actions rather than guess, and to surface the failure clearly instead of failing silently.

Reporting a security issue

If you believe you’ve found a security issue, please contact us through the details on the Contact page so it can be investigated promptly.