Skip to main content

Security

Your credentials and account, protected by design.

Connecting a broker account to anything takes trust. Here's exactly how Trepeat stores your credentials, protects your account, and what it can never do with your money.

Your credentials

How your broker credentials are stored

Encrypted at rest, isolated from their keys, and never exposed to the browser.

Encrypted in a vault, apart from your account

Broker credentials are stored in Supabase Vault, encrypted at rest and kept separate from your account rows — never as plain text in our tables. For MetaTrader, our connection provider MetaApi also holds the login to keep the account connected.

Keys isolated from the data

The encryption keys are held separately from the encrypted rows and never reach your browser. Credentials are decrypted only on our servers, by the engine and our broker-connection services.

Encrypted in transit, end to end

Every connection — browser, engine, broker gateway, database — runs over TLS 1.3. Nothing sensitive crosses the wire in the clear.

Your account

How your account is protected

Strong authentication, fresh checks on the actions that matter, and data scoped to you.

Passwordless, with optional two-factor

Passwordless sign-in, optional TOTP two-factor authentication, and recovery codes plus a backup email to get back in if you lose access to your inbox.

Fresh step-up on sensitive actions

If you've turned on two-factor, deleting your account, opening billing, charged billing changes and changing your sign-in email need a fresh code — an old session alone isn't enough.

Your data is scoped to you

Row-level security on every table means a request can only ever read or write your own rows — enforced in the database, not just the app.

What Trepeat never does

  • Never holds or withdraws your money.Trepeat can place and close trades, but it can never deposit, withdraw, or move funds. The money and the broker relationship stay entirely yours.
  • Never exposes credentials to the browser.Your broker credentials are decrypted only on our servers, by the engine and our broker-connection services — they never travel to your device.
  • Never logs your secrets.Passwords, tokens, and recovery codes are hashed or masked — they don't appear in logs, ever.

Built on infrastructure you can verify

The engine runs on AWS (ECS Fargate, us-east-1) behind an application load balancer, with the site on Amplify + CloudFront, Supabase for auth + Postgres + Realtime, MetaApi for MetaTrader and cTrader's Open API for cTrader. Structured logs end to end, daily encrypted backups retained for 7 days.

Found a vulnerability? Read our responsible-disclosure policy

Connect with confidence.

Encrypted credentials, two-factor sign-in available, and an engine that never touches your funds.

Start free trialSee how it stays reliable

Free trial on cTrader1 week · up to 3 accounts · no card

MT4 and MT5 connect as soon as you subscribe.