// Security & confidentiality
Having a trading system built means handing something over: an idea, a set of data, sometimes market access. This page says how we handle it — and names openly, at the end, what we cannot show you.
// Principles
Every mandate has its own storage, its own version control and its own credentials. Nothing from one project sits where another is being worked on — not even alongside our own systems.
What we build for you belongs to you entirely. No resale, no second edition, no use of your parameters or results as a starting point for another house's work.
We ask only for what building requires — as a rule market data and a technical specification. No personal data, no client data of yours, no portfolio holdings, no authority over accounts.
Every change is versioned, every access to a running system logged. Who changed what and when is still answerable months later — for you as much as for us.
// In detail
Security is not decided by a statement but by small things: where a key is kept, who can revoke it, what happens to it after the last working day.
We are a small house — you know by name who works on your project.
Credentials for the data feed and the broker are the most sensitive thing in the whole project.
What you give us stays limited to what building actually requires.
Where a system runs is your institution's decision, not ours.
The most important part: what happens once we are finished.
What applies to commissions applies to the page you are on right now.
// Sequence
Confidentiality is not a declaration at the start but a chain of steps. Here it is.
Before you tell us any detail, we sign a non-disclosure agreement — yours or ours, your choice. For a first exploratory conversation we need no confidential information at all.
We settle what documents are exchanged over and who may see them. Not an attachment on some e-mail, not a folder with a service nobody has named.
Your project gets its own environment with its own version control. It is separate from our own systems and from every other mandate.
Testing runs first without market access, then with separate test credentials. Only at trial operation do real credentials come into play — in your name, with the rights needed for it and no others.
You get everything: source code, test report, logs, operating manual. From that point your house can run the system without us — that is the standard we measure the handover against.
After the agreed period we delete our working copies and confirm it to you in writing. What remains with us afterwards is the fact that we worked for you — and even that we mention only if you release it.
// Honestly
This list is here so that you do not have to discover it in the questionnaire.
We are not certified to ISO 27001 and hold no comparable seal. What we commit to is in the contract — not in a certificate.
Our procedures have not so far been examined by a third party. If your policy requires that, we will tell you in advance whether and how we can provide it.
We monitor the systems we operate continuously, but we do not maintain a security department of our own. Anyone who needs that structure should look for it at a larger provider.
If your requirements demand something we cannot honestly meet, we turn the commission down. That is cheaper for both sides than a tick in a box that does not hold up under examination.
Send it to us. We will fill it in and state honestly where we have to put a no.
Get in touch How we test