This page is the honest version: what is enforced, what is gated, what we log, what we refuse to log, and what still depends on your own configuration.
Live automated trading is not released because a date arrived. It is released when security, trading, operations and legal gates are all satisfied.
If an attacker compromises the analysis layer, they should still be unable to place an order. If a model hallucinates a trade, it should still be unable to place an order. That single architectural decision removes the most common class of catastrophic failure in automated trading.
| Logged | Retention posture |
|---|---|
| Security and auth events | Tamper-resistant |
| Admin actions with before/after values | Immutable |
| AI tool calls and rejections | Full session trace |
| Strategy decisions per version | Tied to version ID |
| Risk decisions with reason codes | Immutable, queryable |
| Order lifecycle events | Order and fill history never hard-deleted |
| Billing entitlement changes | Auditable subscription events |
Consider disabling new orders, revoke affected credentials, activate incident commander.
Core functionality materially impaired; degrade gracefully rather than fail unsafely.
Narrow impact; scheduled fix with monitoring in place.
Tracked and addressed in normal release cadence.
Audit logs, order history and system state are captured before anything is repaired. Evidence destroyed in the rush to fix is evidence lost forever.
Which accounts, strategies, credentials and downstream systems were touched. Guessing narrower than reality is how a second incident happens.
Every credential with any plausible exposure is rotated, not just the one that looks compromised.
After any restart or interruption, broker positions and orders are reconciled before new execution is enabled. Local state is never assumed authoritative.
A fix without a test is an intention. The regression suite for trading includes duplicate order, timeout, partial fill, stale data, reconnect, broker reject and kill-switch cases.
Targets shown are the baseline to validate with the business. Stricter targets may be required for specific deployment models.
If the answer is not on this page, tell us and we will either publish it or explain why it cannot be disclosed.