Security
CopyTrade handles sensitive brokerage credentials on your behalf. Here's exactly how we store and secure them — and what you should do on your side.
🔐
AES-256 Encryption
Every broker credential we hold — Rithmic and Tradovate logins, Tradovate sign-in tokens, ProjectX API keys — and every two-factor secret is encrypted with AES-256-GCM before it is saved, which also detects any tampering with the stored value. The encryption key is kept separately from the data, and the server won't start without it.
✓ ACTIVE
🪪
JWT Authentication
Logins use signed tokens that expire after 30 days, kept in a secure cookie that page scripts can't read. You're emailed when your account is logged into from a new browser. Changing or resetting your password, or "Log out all devices", signs out every other device straight away.
✓ ACTIVE
📱
Two-Factor Authentication
Authenticator-app 2FA on every plan and during the trial. Works with Google Authenticator, Authy and any TOTP app. Backup codes are given at setup.
✓ ALL PLANS
🛡️
Rate Limiting
Login, 2FA codes, password resets and other sensitive actions are limited to 10 attempts per 15 minutes per IP address, so passwords and codes can't be guessed by brute force.
✓ ACTIVE
🚫
No Fund Custody
CopyTrade never holds, receives, transfers, or has custody of your funds at any time. All money stays in your brokerage account. We only place orders on your behalf.
✓ BY DESIGN
☁️
Cloud Infrastructure
Hosted on Railway behind Cloudflare, with HTTPS enforced on every connection. Each customer can only see and act on their own accounts and data. Daily encrypted backups are kept for up to 30 days.
✓ ACTIVE
⚠ What we store for each broker:
Tradovate: connect with OAuth (recommended) — you sign in on Tradovate's own page and CopyTrade never sees your password; we keep only an encrypted sign-in token, which you can revoke in Tradovate at any time. If you choose to enter credentials manually instead, your Tradovate username, password and API key are stored encrypted.
Rithmic (most prop firms, including Rithmic-based Apex accounts): Rithmic has no OAuth, so the username and password your firm gave you are stored encrypted. Anyone holding them could log in as you, so they are used only to log in to Rithmic on your behalf.
TopstepX: your ProjectX API key, stored encrypted. See our setup guides.
WHAT YOU SHOULD DO
✓
ENABLE 2FA ON YOUR COPYTRADE ACCOUNT
In the dashboard, go to Settings → Two-Factor Authentication. With it on, a stolen password alone can't log in to your CopyTrade account. Included on every plan.
✓
PREFER OAUTH, AND TRADE-ONLY PERMISSIONS
For Tradovate, connect with OAuth so your password is never shared. If you create your own Tradovate API key instead, grant only Orders, Positions, Account, Contract Library and Market Data — never withdrawal or fund transfer permissions.
✓
USE A STRONG UNIQUE PASSWORD
Use a password manager to generate a strong unique password for your CopyTrade account — different from your brokerage password.
✓
MONITOR YOUR BROKER ACCOUNTS REGULARLY
Regularly review your connected accounts for unexpected activity. CopyTrade shows all executed trades in the Log tab.
✓
REVOKE API ACCESS IF YOU SUSPECT COMPROMISE
If you believe your credentials may be compromised, immediately delete the API application in your broker's dashboard — this instantly prevents any further access regardless of what credentials are stored in CopyTrade.
WHAT WE DON'T DO
✗
WE DON'T STORE PLAIN TEXT CREDENTIALS
Broker credentials are encrypted before they are saved — no plain-text API keys or broker passwords are stored. Your CopyTrade password is kept only as a one-way hash.
✗
WE DON'T SELL YOUR DATA
Your credentials and trading data are never sold, and never shared for marketing. They go only to the services needed to run CopyTrade — your broker, Stripe for billing, our email provider and our hosting — as listed in our
Privacy Policy.
✗
WE DON'T TRADE WITHOUT YOUR INSTRUCTION
New trades open only from your TradingView alerts or a trade you place in the dashboard. After that, CopyTrade follows the rules you set: it places and moves the trade's stop-loss and targets, and closes positions when a daily limit or prop rule you turned on is reached, or when you press Flatten. It reads your balances and positions to show them and to apply the limits you set.
✗
WE DON'T HAVE WITHDRAWAL ACCESS
CopyTrade has no feature that moves money and never asks for withdrawal or transfer permissions — the only things it sends your broker are orders. Your money cannot leave your broker account through CopyTrade.
BREACH NOTIFICATION COMMITMENT
In the event of a confirmed security breach affecting stored credentials or personal data, we will notify affected users by email within 72 hours of confirming the breach. We will describe what was affected and provide guidance on protective actions.
🔍 REPORT A SECURITY VULNERABILITY
If you discover a security vulnerability in CopyTrade, please report it responsibly to [email protected] with the subject line "Security Vulnerability." We take all reports seriously and will respond within 48 hours. Please do not publicly disclose vulnerabilities before we have had the opportunity to address them.