Security

Security practices, in plain language.

We're a research and charting workspace, not a custodian of funds — but the data you connect and the strategies you write are still yours, and we treat them that way.

Encryption in transit

All traffic between the browser, API, and WebSocket transport is served over TLS. Internal service-to-service calls within our infrastructure are network-isolated.

Credential handling

Third-party data-provider credentials (broker/market-data tokens) are read-only where the provider supports it, stored server-side only, and never exposed to the browser or logged in plaintext.

Ownership isolation

Every workspace, watchlist, run, and backtest is scoped to its owning account at the data layer. A request for another account's resource is answered as not found, not as a permissions error — so its existence is never confirmed.

Strategy execution

Pine strategy code runs in a separate process with execution-time and input/output limits. Stronger filesystem and network isolation is planned before public beta.

Data retention

Delivery events and run audit logs are retained on a fixed schedule and purged automatically afterward, rather than kept indefinitely by default.

Infrastructure

Services are process-isolated by responsibility (API, WebSocket, market ingest, executor, worker) so a fault in one surface doesn't take down the others.

Found a security issue? Reach out through the contact page — we treat vulnerability reports as priority, not general support.