Read-only by design.
The service is built so that we can see an account without being able to touch it. This page describes how we handle credentials, data and reports, and how to report a vulnerability.
Access to trading accounts
We ask for the investor password. On MetaTrader that password opens one account in read-only mode: it can list trades and balances, and it cannot place, modify or close a position. If a trading password is submitted instead, the review still only reads the account and the reviewer is warned in the job notes. cTrader and Match-Trader are integrated with equivalent read-only authorisation. We never ask for master passwords, API keys, manager access or server credentials, and nothing connects to a firm's infrastructure.
Credential handling
- Credentials are encrypted at rest and only decrypted inside the worker that reads the account.
- They stay saved, encrypted, with the account for later reviews and monitoring; the account owner can remove them at any time from the account page.
- Staff do not see credentials in the clear; support works from the account number and the report.
- Feed accounts never trade. We check that no trading permission exists before using one.
Report integrity
Every report is hashed with SHA-256 and timestamped at issue. The verification link shows the hash and the issue time, so anyone holding a copy can confirm it has not been altered. Reports are never edited; corrections are new documents that reference the original.
Infrastructure
- All traffic is encrypted in transit (TLS). Data stores are encrypted at rest.
- Access follows least privilege and is logged.
- Trading data is kept separate from the public website.
- Rules engine outputs are deterministic and reproducible from the stored inputs.
Data minimisation
We read what a review needs: trades, balance history and account settings. We do not read messages, documents or anything outside the trading account. Reports published to the directory are anonymised and bucketed.
Responsible disclosure
If you find a vulnerability, email our support address with "Security" in the subject and include steps to reproduce. We acknowledge within two business days, keep you informed, and do not pursue good-faith researchers who avoid privacy violations, data destruction and service disruption.
What we do not claim
We do not currently hold SOC 2 or ISO 27001 certification. We will say so here when that changes, rather than implying it before then.