Company

Data security

Davinchu only reads your accounts: the EA trades nothing, an exchange key with withdrawal rights is rejected, and secrets are stored encrypted. Below is exactly what we do and what we don't.

Read-only access to your accounts

  • MetaTrader 5 and 4. The Davinchu Trade Monitor EA sends trades and account state and trades nothing: the server sends it no trading commands. The dashboard never asks for terminal passwords β€” neither the trading nor the investor one.
  • Exchanges. An API key with withdrawal rights is rejected. A key with trading rights is accepted with a warning β€” a read-only key is better; the key's rights are shown on the account card. How to create one on each exchange β€” in Β«Read-only API keyΒ».
  • Brokers. Interactive Brokers connects with a Flex report token, which gives reports only. T-Bank connects with a read-only token; a full-access token is accepted with a warning that it also allows trading, and Davinchu performs no trading actions.
  • Risk manager. Only the T-Manager EA for MetaTrader 5 has trading-command rights β€” if you installed it yourself and gave it a key: it blocks new entries by your limits and does not touch open positions.

How keys are stored

Exchange API keys and secrets and broker tokens are stored encrypted (AES-256-GCM) and are never sent back to the browser: the dashboard shows only a masked key β€” its first and last characters. A key can be revoked β€” the secret is deleted, the account history stays. An EA key can be reissued in the dashboard, and the old one stops working. The site and the dashboard work over HTTPS only, and the EA connects over a secure WebSocket (TLS).

Signing in

  • Passwords are stored only as bcrypt hashes.
  • Two-factor protection β€” an authenticator app (TOTP) or a code by email or Telegram, plus 10 one-time backup codes.
  • Brute-force protection: sign-in attempts are rate-limited, and after 10 failed attempts within 15 minutes the account is temporarily locked.
  • A sign-in session lasts 15 minutes and refreshes for up to 30 days. You can sign out of all devices at once; if an old refresh token is reused, all sessions are reset.

Security notifications

Sign-in from a new device, password change, two-factor protection turned off and a backup code used always reach you β€” bypassing quiet hours and notification pause. When the account email changes, we write to the previous address.

Withdrawals from the balance

Withdrawals go only to whitelisted addresses, and a new address starts working after 24 hours. A withdrawal requires two-factor protection, and backup codes do not work for it. Withdrawals of $500 or more are approved manually.

Public links

Everything is private by default. A public link to an account, journal or portfolio is a random 96-bit token; you decide what it shows with switches, and the server enforces them. Revoking a link is final: the old address never opens again, and a new publication gets a new one. Public pages are closed to search engines.

Your data

In the dashboard settings you can export all data (JSON) and journal trades (CSV). Account deletion can be cancelled within 14 days; after that personal data is deleted, trades are anonymised, and public links and the leaderboard entry are removed. While the balance holds withdrawable funds, the account cannot be deleted β€” withdraw them first.

Report a vulnerability

Found a security issue? Write to [email protected] marked Β«SecurityΒ». Please do not publish details until we reply.