Security & trust
Your funds stay with your broker and your access is scoped. Here's how we keep the platform secure and what we do with your data.
Broker connection
You connect your broker through the official cTrader Open API using a secure authorisation flow. We never ask for or store your broker password, and we cannot withdraw funds — the platform only places trades on your behalf according to the strategy.
Credentials & access
API access tokens are scoped to the permissions you grant and are stored encrypted. Authentication for the dashboard is handled by Supabase, and sensitive operations are protected by row-level security policies.
Audit logging
Every meaningful action — connections, trades, configuration changes and admin operations — is recorded in an audit log so there's always a verifiable trail of what happened and when.
Infrastructure
The platform runs on Cloudflare's global network with isolated per-account processing. Traffic is encrypted in transit, and the trading engine talks to the broker over an authenticated TLS connection.
Reporting a vulnerability
If you believe you've found a security issue, please email us. We take reports seriously and will respond as quickly as we can.