Teams that buy software often send a security questionnaire. These are our standard answers. Use them to fill yours in, and email hello@tickwire.io with “Security” in the subject if a question isn’t covered.
Certifications and outside review
- We hold no SOC 2, ISO 27001 or similar certification.
- No outside firm has tested or reviewed Tickwire yet. There has been no third-party penetration test.
- We plan to get an outside review later. We will update this page when one is done. Until then, please treat every answer here as our own statement.
Data we store
| Data | Kept for |
|---|---|
| Your name, email and company | While your account is open, then 6 years for tax records |
| Broker login and server | Until you delete the trading account |
| Broker password | Until you delete the trading account, or 7 days after your subscription ends, whichever comes first |
| Trading data (balances, positions, orders, deals, prices) | Until you delete the trading account, then 90 days |
| Audit log | 1 year |
| API request logs, with secrets redacted | 14 days |
| Webhook delivery log | 30 days |
We never hold card details. Our payment provider keeps them. The full list is in the privacy policy.
Encryption
- All traffic to the API, the dashboard and this site uses TLS, with publicly trusted certificates.
- Broker passwords are encrypted at rest. They are decrypted only inside the account’s own terminal, when it logs in.
- Broker passwords never appear in logs, error messages, audit records or webhooks.
- API keys are stored hashed, not as plain values.
- Webhook deliveries are signed with HMAC-SHA256, with a timestamp so you can reject replays.
Access control
Your access
- API keys and tokens can be limited to some accounts, made read-only, given a time-to-live, and tied to an IP allowlist.
- An investor (read-only) password means nobody can trade on the account through Tickwire.
- Agent keys, for AI agents, each have a kill switch. Your own pre-trade hook can allow, deny or hold each of their orders.
- Team members in your organisation each have a role, so not everyone can change everything.
- Dashboard sign-in is by email and password, an email sign-in link, or Google. We don’t offer two-factor sign-in of our own yet.
Our access
- Only a few people at Tickwire Labs can reach production servers. They sign in with keys, not passwords.
- Each trading account runs its own terminal, kept apart from the others. Terminals can’t be reached from the internet. Only our API can reach them.
- Every account, key, event and record belongs to one customer.
Logging and audit
- Every change to an account is recorded in an append-only audit log: the time, the actor, the reason, the request and the outcome. We don’t edit audit records.
- You can read your audit log through the API and in the dashboard.
- API request logs keep the IP address, path, status and timing, with secrets redacted.
- See Idempotency and the audit log and Request logs.
Incident response
- Our monitoring alerts the people on call. Problems on our side alert faster than problems at a broker.
- We keep written runbooks for incidents such as leaked credentials, host failures and broker outages. After an incident we write a review of what happened and how to stop it happening again.
- Incidents are posted on the public status page. You can subscribe to email alerts there.
- We have no fixed notice time for a data breach in writing yet.
Backups and restore
- Our database is backed up automatically.
- Each backup is deleted within 7 days of being made.
- We tested a restore in October 2026. The database was restored into a new environment and checked.
- Your positions, orders and history are held by your broker, so losing a terminal doesn’t lose them.
Subprocessors
The privacy policy lists the companies that process data for us, and what each one does. We list any change there before it takes effect. A data processing agreement for business customers is available on request.
Vulnerability reports
Email hello@tickwire.io with “Security” in the subject and steps to reproduce.
- Please don’t test against accounts that aren’t yours, or run denial-of-service tests.
- We acknowledge within two business days, keep you updated, and credit you if you’d like.
- We won’t pursue good-faith research that follows these rules.
Penetration testing
No outside firm has run a penetration test on Tickwire yet. An outside review is planned for later. See Certifications and outside review.