You give us your broker logins and let us place orders. Here’s how we protect them.
What we don’t have
- We hold no SOC 2, ISO 27001 or similar certification.
Isolation
- One account, one terminal. Each trading account runs its own MetaTrader terminal, kept apart from the others. A crash or a hung dialog in one account can’t touch another.
- Terminals aren’t on the internet. Only our API can reach a terminal. Nothing reaches one directly from the internet.
- Customers are kept apart. Every account, key, event and record belongs to one customer. Our own products are set up as customers too, with no special access.
Broker credentials
- Passwords are write-only. The API never returns them, and they never appear in logs, error messages, audit records or webhooks.
- Credentials are encrypted at rest and decrypted only when the terminal logs in.
- You can use an investor (read-only) password for monitoring and journals. Then nobody, us
included, can trade on the account through Tickwire, and the API reports
read_only: trueandtrading_enabled: false.
API access
- Keys and tokens can be scoped to specific accounts, made read-only, given a time-to-live, and limited to an IP allowlist.
- Creating, rotating or revoking a key doesn’t restart any terminal.
- Every mutating call is recorded in an append-only audit log with the actor (
X-Actor), the reason (X-Reason), the request and the outcome. - All traffic uses TLS with publicly trusted certificates on real hostnames, so you never need to turn off certificate checks.
Webhooks
Every delivery is signed with HMAC-SHA256 over "{timestamp}.{body}" using a per-webhook secret,
and carries the timestamp so you can reject replays. See Webhooks for
verification code.
Device identity
Every account’s terminal gets its own machine identity: distinct per account and stable across restarts. Prop firms that check for shared machines see separate devices. With a dedicated IP, your accounts also connect from your own IP.
Operations
- Access to production hosts is limited to named engineers, with keys, not passwords.
- Incidents are posted on the public status page.
Reporting a vulnerability
Email hello@tickwire.io with steps to reproduce. Please don’t test against accounts that aren’t yours, or run denial-of-service tests. We’ll acknowledge within [2 business days], keep you updated, and credit you if you’d like. We won’t pursue good-faith research that follows these rules.