Sign in Open account
Platform
Markets Platform Trading & Execution AI Intelligence
Products
Marketplace Desktop Agent API
Knowledge
Research Academy
Company
Enterprise About Trust & Security Legal
Home/Trust Center

The security and trading model, stated plainly

This page is the honest version: what is enforced, what is gated, what we log, what we refuse to log, and what still depends on your own configuration.

WatchlistINDICATIVE
SYMLASTCHG
XAUUSDGold / USD2,341.8+0.62%
BTCUSDBitcoin / USD67,412-1.04%
SPX500S&P 5005,412.3+0.31%
USOILWTI Crude78.94+0.19%
Release gates

Four gates. All four, or it does not ship.

Live automated trading is not released because a date arrived. It is released when security, trading, operations and legal gates are all satisfied.

A

Gate A — Security

  • MFA and passkeys for privileged accounts
  • RBAC plus resource-level authorisation
  • Secrets manager, no secrets in source
  • TLS in transit, encryption at rest, key rotation
  • WAF and rate limiting at the edge
  • SAST, DAST, dependency and container scanning
  • Penetration test findings triaged
B

Gate B — Trading

  • Deterministic risk engine
  • Idempotent execution with client order IDs
  • Broker reconciliation, including after restart
  • Global kill switch tested
  • Broker failure and timeout tests
  • Deterministic market-event replay tests
  • Paper-trading evidence recorded
C

Gate C — Operations

  • Monitoring and alerting live
  • Encrypted backups, offsite copy
  • Restore procedure actually tested
  • Incident runbooks written and rehearsed
  • On-call ownership assigned
  • Rollback plan per release
D

Gate D — Legal & Business

  • Terms of Service
  • Privacy Policy and consent controls
  • Risk Disclosure
  • AI Disclosure
  • Data licensing terms confirmed
  • Billing and refund terms
  • Jurisdiction review completed
Highest-impact control

Separate analysis from execution

If an attacker compromises the analysis layer, they should still be unable to place an order. If a model hallucinates a trade, it should still be unable to place an order. That single architectural decision removes the most common class of catastrophic failure in automated trading.

  • Deterministic risk gates between signal and order
  • Short-lived, scoped credentials
  • Mandatory MFA for privileged access
  • Immutable audit logs
  • A kill switch that always works
Threats we plan for
Account takeover
Credential theft and broker key exfiltration
Unauthorised trading
Duplicate orders
Prompt injection via external content
Malicious marketplace packages
API abuse and data poisoning
Insider misuse and supply-chain compromise
Ransomware and DDoS
Leakage of proprietary strategy and knowledge IP
Audit and observability

What gets logged, and what never does

LoggedRetention posture
Security and auth eventsTamper-resistant
Admin actions with before/after valuesImmutable
AI tool calls and rejectionsFull session trace
Strategy decisions per versionTied to version ID
Risk decisions with reason codesImmutable, queryable
Order lifecycle eventsOrder and fill history never hard-deleted
Billing entitlement changesAuditable subscription events
Never logged: secrets, access tokens, API keys, broker credentials, or full sensitive personal data. If debugging would require a token, we reproduce the condition instead.

Monitored signals

  • Data latency and feed gaps
  • WebSocket disconnect rate
  • AI latency, error and tool-rejection rate
  • Risk rejection rate by reason code
  • Order acknowledgement latency
  • Reconciliation mismatches
  • Drawdown alerts
When something breaks

Severity model and recovery order

SEV-1

Trading or security critical

Consider disabling new orders, revoke affected credentials, activate incident commander.

SEV-2

Major degradation

Core functionality materially impaired; degrade gracefully rather than fail unsafely.

SEV-3

Limited issue

Narrow impact; scheduled fix with monitoring in place.

SEV-4

Minor

Tracked and addressed in normal release cadence.

01

Preserve evidence

Audit logs, order history and system state are captured before anything is repaired. Evidence destroyed in the rush to fix is evidence lost forever.

02

Identify blast radius

Which accounts, strategies, credentials and downstream systems were touched. Guessing narrower than reality is how a second incident happens.

03

Rotate secrets

Every credential with any plausible exposure is rotated, not just the one that looks compromised.

04

Reconcile against the broker

After any restart or interruption, broker positions and orders are reconciled before new execution is enabled. Local state is never assumed authoritative.

05

Patch root cause, then add the regression test

A fix without a test is an intention. The regression suite for trading includes duplicate order, timeout, partial fill, stale data, reconnect, broker reject and kill-switch cases.

Recovery targets

Backups are a claim. A tested restore is evidence.

≤ 15 min
RPO for critical transactional data
≤ 60 min
RTO for the core platform
Offsite
Independent backup copy, encrypted
Tested
Restore procedure rehearsed, not assumed

Targets shown are the baseline to validate with the business. Stricter targets may be required for specific deployment models.

Get started

Ask us the uncomfortable security question

If the answer is not on this page, tell us and we will either publish it or explain why it cannot be disclosed.