Trust center
Trust is earned. Here's our working.
What protects your keys and accounts, how we check it, and what's still open.
- Withdraw rights on any key we accept
- 0
- Envelope encryption for every exchange key
- AES-256-GCM
- Between you, Cloudflare and our servers
- TLS 1.3
- Where production runs
- Singapore
Controls
What protects you, and what's still being built.
19 live, 2 in progress, 1 planned. Updated 14 Oct 2026.
Your funds
We never hold money
LiveYour balance stays at your exchange or prop firm. TradeSurge places orders; it can't move funds.
Trade-only keys
LiveKeys that can withdraw or transfer are refused, and you confirm trade-only before a key is saved.
Exits are never blocked
LiveClose, flatten and the kill switch work whatever your plan, your limits or our copy switches say.
Your exchange keys
Sealed per record
LiveEach key gets its own data key, wrapped by a master key that lives outside the database.
Bound to you
LiveA sealed key moved to another row or another user fails to open.
Never shown again
LiveNo page or API returns a secret. You see the first and last four characters, nothing more.
Revoke means delete
LiveRevoking erases the encrypted secret and removes the key from every copy group.
Your account
Verified sign-in
LiveEmail verified at sign-up, and a one-time code for every browser you haven't trusted.
Password before anything live
LiveAdding a key, turning a copy group live and opting into live copying ask for your password again.
Your security log
LiveSign-ins, key changes, copy changes and kill switches, listed in Settings with time and device.
Sessions you control
LiveSee every signed-in device and trusted browser, and sign them out one by one or all at once.
Authenticator app (TOTP) for traders
PlannedStaff already sign in with a password and an authenticator code. Traders get the same option next.
Our platform
Dry run by default
LiveA new copy group works out every copy and logs it without placing an order until you turn it live.
Platform hard caps
LiveCeilings on order size, exposure, leverage and copies a day sit under every limit you set.
Tenant isolation, tested
LiveEvery query is scoped to your account, and tests check every API route for who may call it.
Secret and dependency scans
LiveEvery change is checked for committed secrets and known-vulnerable packages before it merges.
Server hardening
In progressOrigin locked to Cloudflare, firewall and SSH lockdown on every host, pull-only deploy credentials.
Offsite, encrypted backups
In progressNightly database backups are kept 14 days on the server today; an encrypted offsite copy is next.
Our team
Staff never see keys
LiveOur back office reads through a read-only role limited to named columns. It can't select a key, a secret or a password hash.
Staff sign-in with a second factor
LivePassword plus an authenticator code; recovery codes are single use and stored hashed.
Signed internal calls
LiveEvery back-office and engine request is signed, time-limited and refused if replayed.
Production behind a VPN
LiveDashboards and the container console answer only on our private network.
Security reviews
We look for holes before anyone else does.
Every review, what it covered and where its findings stand. Details stay private until they're fixed.
Follow-up review
13 Oct 2026 · Internal
Everything shipped since the full review: TradingView signals, firm rule packs, metrics and the help center.
Findings by severity Severity Found Fixed in production critical 0 0 high 0 0 medium 0 0 low 7 0 Total 7 0 7 still open, each with an owner on our board. Fixed means the fix is running in production, not just written.
Full security review
10 Oct 2026 · Internal
The app, the copy engine, the back office, this website, our infrastructure and both servers.
Findings by severity Severity Found Fixed in production critical 0 0 high 5 1 medium 5 2 low 8 5 Total 18 8 10 still open, each with an owner on our board. Fixed means the fix is running in production, not just written.
Compliance
No badge we haven't earned.
Where we stand on each standard, in plain words.
Designed toward
ISO/IEC 27001
Our controls are mapped to Annex A. We're not certified and won't say we are until an auditor says so.
Card data at Stripe
PCI DSS
Card payments go to Stripe, which is PCI DSS Level 1. Card numbers never reach our servers.
Not started
SOC 2
On the roadmap after ISO/IEC 27001.
Subprocessors
Who else touches your data, and why.
Every company that processes data for us. Your exchange keys go to none of them.
- CloudflareDNS, CDN and web firewallRequest metadataGlobal
- Tencent CloudServers and databaseAccount and trading dataSingapore
- AnthropicSurge Copilot answersThe question and the account facts it needs, never keysUnited States
- StripeSubscription paymentsBilling details and card dataGlobal
- ResendSign-in codes and alerts by emailEmail addressUnited States
- Your exchangePlacing your ordersOrders, signed with your trade-only keyWhere your exchange runs
Responsible disclosure
Found something? Tell us first.
We'd rather hear it from you than read it anywhere else.
- Email [email protected] with “Security report” in the subject: what you found, how to reproduce it, and what it lets someone do.
- Test only against your own account. Don't read, change or delete anyone else's data, and stop once you've shown the problem.
- No denial of service, spam or social engineering of our team or our traders.
- Act in good faith within these rules and we won't take legal action. We'll confirm we got your report, keep you posted, and credit you if you'd like.
- Machine-readable contact: security.txt
FAQ
Trust questions
Every funded account. One cockpit. Take command.
7-day free trial on every plan. Cancel anytime.