Security

Connecting a brokerage account to a third party is a reasonable thing to be cautious about — here's exactly what access we have and how it's protected.

Credentials

For brokers that support OAuth, we hold only the token they issue us — your actual broker password never reaches our servers. For brokers that require an API key instead, that key is encrypted at rest and decrypted only for the moment an order is being sent. Disconnecting a broker — from your dashboard or from the broker's own settings — revokes that access immediately.

Custody

Your capital never leaves your own brokerage accounts. What you authorise us to do is read balances, positions and orders, and place or cancel trades on your behalf — deposits, withdrawals and transfers aren't part of that permission, and there's no path in our system that would let us move your money even by mistake.

Data protection

• Traffic is encrypted end-to-end with TLS.
• Stored data is encrypted at rest.
• Passwords go through a slow, modern hashing algorithm — nobody, including us, can read them back; a forgotten password can only be reset, never recovered.
• Two-factor authentication is available on your account, and we'd recommend turning it on.

Operational practice

• Development and production run in separate environments.
• Anyone with administrative access has to clear multi-factor authentication first.
• Access and application logs are centralised, so anything unusual is visible quickly.
• Dependencies are checked on an ongoing basis for known vulnerabilities.

Reporting a vulnerability

Found something concerning? Email info@ezpztrader.com with enough detail to reproduce it. We'll confirm we've seen it and keep you posted while we work through a fix — please hold off on public disclosure until we've had a fair chance to patch it.