Security

1. The most important thing to understand

We do not hold your money. We cannot move your money. We have no custody relationship with you and no mechanism to withdraw from your trading account. This is the single largest security control we have, and it is a structural one rather than a policy promise.

We will never ask you for your broker password, your withdrawal permission, or a one-time password or PIN. No legitimate reason to operate a trading platform requires them. Anyone who does is not us.

2. What we do

Encrypt data in transit

all connections to the platform and to broker APIs use TLS, and broker credentials are encrypted at rest.

Least-privilege access to credentials

a connection requests only the permissions the product needs, and trading-only scopes are preferred over any broader grant. Withdrawal scopes are not required and are not requested.

Restrict internal access

access to customer data and credentials is limited to staff who need it, is logged, and is reviewed periodically.

Segregate environments

production is separated from development and testing, and production data is not copied into test environments.

Maintain a vulnerability practice

we keep dependencies current, and we will disclose a confirmed vulnerability affecting your data when we fix it.

3. What we do not do

We do not store your broker password. We hold the credentials necessary for a connection you authorise, encrypted, and you can revoke the connection at any time. We do not store full card details. We do not sell or rent data. We do not run undisclosed third-party advertising or tracking scripts on pages where you are authenticated.

4. Your responsibilities

Security is shared. Use a unique password, enable two-factor authentication wherever it is offered by your broker, keep your own devices patched, and do not share credentials with anyone. Do not leave an unattended session authenticated on a shared machine. If you believe your credentials are compromised, change them at your broker first, then tell us.

5. If something goes wrong

We maintain an incident response process for a suspected breach affecting your data. Where a breach is likely to harm you, we will notify you and the relevant authority within the period the law requires, with what we know, what we are doing, and what you should do.

6. Reporting a vulnerability

If you believe you have found a security issue, email info@trademetrix.tech with enough detail for us to reproduce it, and please do not access other customers' data while testing. We will acknowledge your report and will not pursue legal action against good-faith research that we are given reasonable time to fix.

7. Honest limits

No system is perfectly secure. Software contains defects, third-party services can be compromised, and networks can be intercepted. Our security measures are proportionate to the risk and are not a guarantee. We would rather state this plainly than imply a level of protection we cannot promise.