Security & trust
How we handle your accounts, data, and risk
Trading software should earn trust through design, not slogans. Here's exactly how Yuppie Trade is built.
Account permissions
Integrations use broker-issued authorization with the narrowest permissions available. We never request withdrawal access where a broker lets us avoid it, and we never ask for your broker password.
Your data
Credentials and tokens are encrypted and stay on our servers — they're never sent to your browser. We collect what's needed to run the service and don't sell personal data.
Automation you can see
Every signal, order, and setting change is logged. Simulated and live activity are labeled differently everywhere, so you always know which is which.
Risk stays with limits
Strategies — including AI drafts — must pass your position and loss limits before any order is sent. You can pause or stop automation at any time.
Our practices
These describe how the platform is being built. Features ship only when these controls are in place.
Authentication & sessions
- Passwords hashed with a modern, slow algorithm — never stored in plain text.
- Secure, httpOnly session cookies with expiry; sessions can be signed out everywhere.
- Rate limiting on sign-in and other sensitive endpoints.
Credentials & integrations
- Broker tokens encrypted at rest and only ever used on our servers.
- Least-privilege scopes; no withdrawal permissions where the broker allows us to avoid them.
- You can revoke an integration from Yuppie Trade or directly from your broker at any time.
Automation safeguards
- Server-side risk checks run before every order, including AI-drafted strategies.
- Explicit confirmation before any strategy can trade a live account.
- Agents halt and move to Error on connection loss, rejected orders, or expired authorization.
Accountability
- An audit log of sign-ins, integration changes, strategy changes, and orders.
- Each customer's data is isolated and every request is authorized on the server.
- Secrets live in environment configuration, never in source code or the browser.
What we don't claim
We don't hold third-party security certifications today, and we aren't registered with any financial regulator. We will only state a certification or registration here once it has actually been obtained and can be verified.
Report a vulnerability
If you believe you've found a security issue, please contact us with the “Security report” topic. Please give us reasonable time to fix it before disclosing it publicly, and don't access other people's data while testing.
See the platform for yourself
Explore the product, read how it handles risk, and decide whether it fits the way you trade.