Company

Security

You're trusting us with a broker login, so here is exactly what we store, how it's protected, and what we can't yet promise.

We ask for the least each platform allows

  • MT5: the investor password only. The investor password is read-only by design. On first sign-in we check whether it can trade. If it can, we reject it, delete it and ask you for the investor password instead.
  • cTrader: OAuth, view-only. You approve access on cTrader's own site and we never see your password. We only ask for cTrader's view-only accounts scope. The app has no option to request trading access.
  • TradeLocker: password, with your explicit consent. TradeLocker has no read-only password. We say so before you connect, and we ask you to confirm. The password is used to get a short-lived token for each sync. That token is never stored.

Credentials are encrypted and never shown back

  • Passwords and tokens are encrypted with AES-256-GCM before they reach the database.
  • Each one is bound to the account it belongs to, so it can't be copied onto another account and still decrypt.
  • The key is held outside the database. A copy of the database or one of its backups contains only ciphertext.
  • No API returns a credential, not even to you. After you save one, the app only ever shows its status. The only code that decrypts it is the sync worker, which authenticates to the server with a separate secret.

Used to read, never to trade

Our sync code reads trade history, balances and instrument data. Nothing in it places, modifies or closes an order.

Disconnecting an account deletes its stored password or tokens. Deleting an account deletes its trades and credentials together.

Your PropVexis account

  • Everything is served over HTTPS.
  • Sign in with Google, or with an email and password. We store passwords only as a salted scrypt hash.
  • Your session lives in a signed, httpOnly cookie, so page scripts can't read it. Resetting your password signs out every other session.
  • Sign-in attempts are rate-limited. A failed sign-in gives the same answer whether or not the email has an account, so nobody can use it to find out who uses PropVexis.
  • Every request for your data is scoped to your user, and you can never read another trader's trades.

Infrastructure

  • The app and its database run on AWS in Mumbai (ap-south-1).
  • Server secrets come from AWS's secret store at boot, not from files on disk.
  • Nightly backups go to a private S3 bucket with all public access blocked. S3 encrypts them at rest, and they expire after 90 days.
  • We use error monitoring that is configured not to attach personal data.
  • There are no third-party analytics or ad trackers.

What we don't have yet

PropVexis is a small, early-stage product. There is no third-party security audit or certification yet, and the app runs in a single AWS region. We'll update this page when that changes.

Reporting a vulnerability

Email security@propvexis.com with the steps to reproduce. We'll acknowledge your report, keep you updated, and credit you if you'd like. If you research in good faith, we won't take legal action against you. That means you:

  • test only against your own account;
  • don't access, change or keep anyone else's data;
  • don't degrade the service;
  • give us reasonable time to fix the issue before you disclose it.