Security
What stays on your computer, and what we hold.
The design starts from one rule: the thing that can spend money lives on your machine, and the thing we run in the cloud cannot spend it. Here is what that means in practice.
Broker credentials never leave your computer
Tokens and API keys are kept in the operating system's credential store, encrypted under a key that exists only on your machine. Our servers have no copy and no way to place an order.
Our servers decide entitlement, not trades
The cloud holds your account, subscription and device list, and hands your app a short signed lease that says whether it may arm. It never sees a quote, a position or an order.
Sign-in that resists theft
Passwords are hashed with Argon2id. Sessions use short-lived signed tokens and rotating refresh tokens; a stolen refresh token that is replayed kills the whole session family and emails you. Two-step sign-in is available to everyone and required for us.
Updates are signed and never mid-trade
The app verifies every update against a key baked into it and refuses to install one while the desk is armed or holds a position. Bad builds can be pulled in minutes.
Payments go to Stripe, not to us
Card details are entered on Stripe's pages and never touch our servers. We see the status of your subscription and nothing more.
Everything the server does is audited
Sign-ins, device changes, administrative actions and billing events leave an audit trail. Admin actions need a separate credential from an allowed address. You can export what we hold or delete your account from the app.
Reporting a vulnerability
Write to [email protected]. Tell us what you found and how to reproduce it. We answer within two business days, fix confirmed issues before disclosing them, and credit reporters who want it. Please do not test against other people's accounts or data. Our machine-readable policy is at /.well-known/security.txt.