Security
Your credentials, your code, your data
You are trusting us with a broker login and, if you host an advisor, with your strategy. Here is what we do with that trust. We describe the commitments, not the machinery.
Credentials
- A broker password travels once, over TLS, into a vault, and is used by reference from then on.
- No API returns it. The SDK cannot print it, log it or pickle it.
- Rotate it any time; the terminal re-logs in without downtime.
API keys
- Public-key signing on every request; the private half is shown once and never stored by us.
- Keys are scoped and revocable; rotation is an overlap, not an outage.
- A request more than 30 seconds from our clock is refused, and each carries a one-time nonce under its signature, so a captured request cannot be replayed.
Isolation
- Your terminals, events and data are yours. No customer can see or reach another's.
- Your expert advisor runs under a least-privilege account with processor and memory held, and no path to another customer.
- Internal operator access is role-based and every operator action is in the audit trail.
Your code
- Source is built by us and audited before it runs; the report is yours.
- Secrets found in source are deleted at once and never stored.
- Your advisor's own notes go to you and to nobody else; we keep none of them.
Data and residency
- Terminals run in the region you choose; the account data they read stays there.
- We hold no broker account and move no money.
- Backups are encrypted and retained for a published period.
Operations
- Availability measured per minute from inside and outside, and published.
- Incidents are disclosed on the status page in the operators' own words.
- Planned maintenance is announced with what is affected.
Found something?
Report a security issue to support@mfxhub.com with "security" in the subject. We acknowledge within two business days and we do not pursue good-faith researchers.