Public web, authenticated terminal, desktop agent and future mobile or API clients share one identity, entitlement, data and audit architecture. Analysis and execution are separated by a deployment boundary, not by convention.
Every service ships with health checks, structured logs, metrics, tracing, unit tests and integration tests. Trading services additionally require deterministic replay tests before release.
Single entry point for public web and API clients, with rate limiting and abuse detection at the edge.
OIDC/OAuth2 with short-lived access tokens and rotating refresh tokens.
Entitlements derived from verified billing state — never from a client-submitted plan name.
Feed connections with gap detection, sequence tracking and quality flagging.
All sources mapped onto one canonical event model with provenance retained.
Time-series queries over PostgreSQL and TimescaleDB with partitioned retention.
Immutable version IDs, code hashes, parameter sets and test results per release.
Deterministic replay with fees, slippage, spread and latency assumptions recorded.
Routes tasks to specialist agents under tool allowlists and context boundaries.
Version-aware retrieval over approved documents only, with ACL on proprietary methodology.
Independent deterministic gate. Fails closed. Every decision an immutable audit event.
Idempotency keys, client order IDs, state machine, reconciliation on UNKNOWN.
Adapter interfaces for MT5, cTrader and exchanges with declared capabilities.
In-app, email and desktop channels, with trading-critical alerts kept distinct.
Tokenised payments, authenticated idempotent webhooks, reconciled entitlements.
Tamper-resistant structured audit events across auth, AI, risk and order lifecycle.
Trading services run in private network segments. Secrets live in a secrets manager, never in source code or frontend configuration. This is a network boundary, not a coding guideline.
Next.js, React and TypeScript, built for speed, accessibility and indexability.
Python and FastAPI services with versioned REST APIs and a mandatory OpenAPI specification.
PostgreSQL with TimescaleDB for time series, Redis for caching, rate limits and short-lived state.
WebSocket with an event bus from day one; heavier streaming infrastructure only when scale justifies it.
Least privilege, deny-by-default, and a hard separation between viewing a broker account and trading it. Authorisation is always enforced server-side — frontend controls are user experience, never a security boundary.
| Role | Scope | Elevated requirement |
|---|---|---|
| Visitor | Public pages, market snapshots | None |
| User | Watchlists, charts, basic analysis | None |
| Pro User | Screener, AI Copilot, research library | MFA |
| Trader | Paper trading, portfolio, journal | MFA |
| Auto-Trader | Live execution on entitled accounts | MFA + account entitlement + strategy entitlement + risk profile |
| Creator | Publish marketplace products | MFA + verification review |
| Risk Operator | Risk policy, kill switch | MFA + step-up auth + reason code |
| Admin / Super Admin | Platform configuration | Phishing-resistant MFA, no shared accounts |
The Trust Center publishes the security model, release gates and audit posture without marketing gloss.