Security Whitepaper

Our platform operates on a strict Read-Only permissions ledger. By connecting with Investor Passwords (MetaTrader) or Read-Only API Keys (Crypto Exchanges), it is cryptographically impossible to:

• Initiate, modify, or close any trading orders.
• Request withdrawals or transfer capital.
• Alter account settings, leverage, or balance limits.

⚠️ WARNING: Never share your Master Password. The system will reject connections that grant full trade execution or write permissions.

All data transmitted between the client browser, secure proxy controllers, and the isolated backend gateways is protected by industry-standard encryption protocols:

• TLS 1.3 Transport Encryption: Secures connections in transit against man-in-the-middle (MITM) attacks.
• Server-to-Server Authentication: Secure proxy controllers forward requests to the isolated backend gateways using cryptographic bearer tokens.
• Credentials Isolation: Read-only passwords are retrieved directly from the secure relational database on the server-side, never exposed to client-side browsers or public networks.

We leverage an enterprise-grade relational database architecture equipped with strict Row Level Security (RLS) policies.

• Every query is authenticated against a verified identity token.
• Granular database security policies restrict write, read, and delete operations strictly to authorized account owners.
• Public profiles only display specific aggregated metric fields (Win rate, Drawdown, Profit) and respect the privacy flags.

To eliminate fraudulent portfolios where scammers host custom, fake MT5 servers to fabricate trades:

• We enforce a whitelist of top-tier regulated brokers (e.g. ICMarkets, Exness, Vantage, AvaTrade, FOREX.com).
• All server names are verified case-sensitively against approved IP addresses and licensed server substrings.
• Connections to private, custom, or unlicensed MetaTrader servers are blocked at the proxy gateway level.