Built to come back exactly as it was
Every price and every account action is written to a journal before it takes effect. That one decision is what lets the platform restart without losing anything, prove what happened to any account, and refuse to trade on a price it can't trust.
Reliability
What happens when something goes wrong.
- The journal
Each accepted price is recorded once, with its sequence number, before any account sees it. Each account's requests and results are recorded in order. Storage grows with prices, not with prices times accounts.
- Restarts
On start, every account comes back identical: balances, positions, orders and floors. Prices from before the restart are marked unusable until fresh ones arrive. If a crash cut off the last events, they are written and published. If an account's journal ever disagrees with its rebuild, only that account stops, with the reason.
Restarts stay quick however long the history grows. Each account saves its complete state regularly and at every shutdown, so a restart only replays what came after, and the price history is read from the database as it is replayed, never all at once.
- Replay on demand
Staff can rebuild any account from its first day at any time. The replay checks every recorded event and every saved state on the way, and shows exactly where anything differs.
- Prices in doubt
Bad prices, spikes, stale prices, halts and market hours are handled by the price guard. Trading stops rather than use a doubtful price. How the guard works
- Tested on every change
The whole loop, from sign-up to a paid payout, runs as automated tests on every change, against a real database. So do breaches, a restart mid-session, forged and repeated payment messages, cutting and restoring prices, and staff two-factor sign-in.
- Reviewed
The trading engine, the price guard, the account lifecycle and payouts have been through separate, adversarial code reviews. Every issue they found is fixed and kept as an automated test that runs on every change.
- Backups
Nightly, encrypted and stored off-site, in another location. Restoring from them has been tested.
Security
Who can get in, and what they can do once they are.
- Staff two-factor sign-in
Compulsory for every staff member: a password and an authenticator code. Each code works once. Until the second factor is entered, a staff session can only finish signing in or sign out.
- Trader two-factor sign-in
Optional for traders, with an authenticator app; each code works once. Turning it on, or changing the password, signs the trader out of their other sessions. If a trader loses their phone, staff can switch it off after checking it's them, and that is recorded with a reason.
- A separate back office
The back office runs on its own host. The staff API answers only there.
- Passwords and sign-in
Passwords are stored with a strong, slow hash (Argon2id). Sign-in is rate-limited per email address.
A forgotten password is reset through a one-time link by email that works for an hour. Using it signs the client out everywhere else, and older links stop working.
- Identity documents
Identity checks happen on the identity-check provider's own page. The documents go to the provider, never to the platform; the result comes back by signed message.
- Accounts stay private
A trader asking for someone else's account gets the same "not found" as for an account that doesn't exist.
- Two people to move money
Payouts, refunds and affiliate payouts each need one staff member to approve or ask for them and a different one to record the payment.
- Firms kept apart
When one installation runs more than one firm, firms can't see or change each other's data, and a sign-in at one firm doesn't work at another. An automatic test covers this.
- API keys and webhooks
Each API key is shown once and can be revoked at once by any staff member. Everything a key changes is in the audit log. Every webhook is signed so the receiver can check where it came from.
- An audit trail
Staff sign-ins, overrides, challenge changes, payment confirmations, payout decisions, refunds, identity-check changes and client notes are in the audit log, with who, when and why.
- HTTPS everywhere
Every address is served over HTTPS only. Session cookies are secure and not readable by page scripts.
Identity checks run in test mode today, like card payments; live providers for both are on the roadmap.