Your keys never reach us
Most of what makes PTQ safe is a design decision, not a feature: the hosted platform is built so that the dangerous things are not reachable from it at all. This page says exactly where the line sits, what enforces it, and — at the bottom — what we have not done yet.
No absolutes on this page. Software written by people has flaws, and a page that claims otherwise is telling you something it cannot know.
01
Broker keys stay on your machine
They go into your computer's own secret store. They are never transmitted to us, and there is nowhere on our side for them to land.
02
The hosted side refuses them
Not by policy. By code. The hosted surface stores METADATA only, and a request carrying a secret-shaped field is rejected with an error saying so.
03
Every order passes one choke point
Paper or live, from anywhere, the same risk checks run before anything routes. There is no path around them.
04
Stopping is always allowed
The kill switch engages without a licence check, from anywhere, with no confirmation step. Turning it back off is the direction that needs authority.
Two halves, one line between them
The hosted platform does the research: building, backtesting, validation, paper trading, your history. It holds no broker keys, executes nothing at a venue, and has no route that arms live trading — that route does not exist there to be found.
The PTQ OS runs on your own computer. Broker keys, live orders and the arm step live there and only there. The routes on your machine that touch credentials refuse any caller that is not on that machine — including a page served from a domain we ourselves allow for everything else.
One thing crosses the line inward: a signed licence lease. Nothing crosses it outward. Not keys, not order authority, not the contents of your machine.
Stored by your operating system, not by us
When you connect a broker, the keys are entered on your machine and handed to the secret store your operating system already runs. They are written over standard input rather than a command line, because a command line is visible to other processes. They are never logged, and no status call ever returns them.
| Platform | Where the secret sits | Status, honestly |
|---|---|---|
| macOS | The login Keychain, written through the system tool over stdin | Round-trip exercised on real hardware |
| Windows | DPAPI, current-user scope | Implemented to spec; no Windows host here to exercise it yet |
| Linux | The Secret Service, when a keyring is installed | Implemented to spec; no Linux host here to exercise it yet |
| Fallback | A file in your PTQ home directory, owner-read-write only (mode 600) | Used when no OS store answers — and the product says which it used |
The product reports where a secret actually landed, not where it would have preferred to put it. If the OS store is unavailable and the file fallback is used, that is what the status tells you.
The hosted platform rejects secret-shaped fields
A promise not to store something is worth less than a service that will not accept it. The hosted credential surface holds metadata only — which provider, your label for it, the scopes, a short mask. Send it a field named like a secret and the request is refused before anything is written:
“this service stores credential METADATA only — never send the secret itself. Keys stay on your machine.”
That is the exact response the service returns, not a paraphrase of an intention. The same surface refuses a mask that looks like a credential rather than a mask, and it allows only data and trading scopes — never withdrawal.
Short-lived leases, one device at a time
The licence is not a string the software checks against itself. It is a lease your device gets from our server, and the important properties are all on our side of the wire.
Signed on the server
Leases are signed with an Ed25519 key that exists only on our server. Your device checks the signature and expiry every time. An edited lease fails.
Short-lived and per-device
A lease covers one device and expires in days, so it must be renewed against a server that can say no. Seats are counted where the licence lives.
Credits metered server-side
Anything that costs compute is charged against a balance our server holds. There is no local ledger to edit, and a negative charge cannot mint credits.
Enforcement is on by default everywhere, and in a production build it cannot be switched off by configuration at all — the environment variable that turns it off in development is ignored outright. The gate is a wrapper at the mount point rather than a check each route opts into, so a route added tomorrow is gated the moment it exists.
One gate, in a fixed order, every time
Paper or live, submitted from the app, the command line or the Claude connector, every order walks the same ordered list before anything routes. It is one function, not a policy repeated in three places, which is why there is no surface with a weaker version of it.
- 01Kill switch — engaged means every order is rejected, full stop.
- 02Your confirmation — an unconfirmed order never routes.
- 03Per-trade risk verdict — block, or trim the size before routing.
- 04Live permission — your risk profile has to allow live at all.
- 05Broker configured — the live path never invents a fill to keep going.
- 06Arm state and a one-time token issued on your machine, not a body field.
- 07Simulated prices refused — a live plan sized off a simulated quote stops here.
- 08Slippage bound — a fresh quote past your limit refuses rather than chases.
- 09Portfolio authority — gross exposure, per-symbol cap, open positions, daily loss halt, max-drawdown stop, orders per day.
- 10The journal — every fill, trim and refusal is recorded, including the refusals.
An order that reduces a position you already hold bypasses the portfolio caps on purpose. A risk limit must never trap you in a trade you are trying to exit.
Stopping never asks for permission
Engaging the kill switch takes no licence check and no confirmation dialog. A safety brake you can be locked out of is not a safety brake, so the route that engages it is deliberately the one open route in an otherwise deny-by-default API. While it is engaged, every submission is rejected at the choke point above — paper included.
Releasing it does go back through the licence gate, because that is the direction that widens what can happen. The same asymmetry runs through the rest of the product: pausing the unattended loop and disarming a strategy are always allowed and never need a confirmation; arming one is local, explicit, scoped and expiring.
The full list, not a summary
This is the same list the privacy policy carries. If something is not on it, we do not have it.
Account
Your email, your name if you gave one, and sign-in records — held through our authentication provider.
Strategies
The strategies you create and their configuration, so the product can show you your own work.
Risk profiles
Your risk profile, limits and settings, including the mechanics you have switched on.
Paper trades
Simulated fills, labelled simulated, plus your backtest and validation results.
Usage
Which features you used and when, and the credits you spent — the ledger that makes metering honest.
Consent record
The jurisdiction you declared and the acknowledgements you ticked, with a timestamp.
Support
Tickets and in-app support conversations, which may be processed by an AI assistant to draft answers.
Payment records
From Stripe: name, email, what you bought, the amount and their identifiers. Card numbers never reach us.
Export and deletion are built in and never sit behind the paywall, so a lapsed subscription cannot hold your work hostage. Deletion cascades — armed strategies, routines and autopilot records go with the account rather than being left orphaned. The marketing site sets no marketing cookies and runs no advertising trackers; the analytics it uses are cookieless and aggregate.
The three that matter most
Move your money
We are not a broker and hold no client money. Your money sits at your broker, in your name. Keys are scoped to data and trading, never withdrawal.
Trade on your behalf
No web route can arm live trading. It happens on your own machine, with a scope and expiry you set. Edit your limits and a standing arm dies.
See your broker credentials
They never leave your machine. Never logged, never returned by a status call, never put on a command line.
What we have not done
A security page that lists only strengths is marketing. These are the open items as they stand today, in the same words we use internally.
The download is not signed yet
Code signing needs a developer account we do not have yet. Until then the published checksum is the integrity story, and the install notes say exactly what your computer will warn you about an unsigned build.
Software on your machine is yours to modify
Anyone determined can patch a local product on their own hardware. So credits and revocation live on our server. A modified copy can spend nothing, and still cannot place an order without your broker keys.
The live path has never met the venue
The live order path is written and its refusals are tested, but no order has been sent to a broker in live mode. Paper is what we can show working today.
The legal documents are still with counsel
The list of what we hold above is the same list the privacy policy carries.
Asked most often
Where exactly are my broker keys stored?
How does the licence check work?
What can PTQ never do?
Is the download signed?
More on the FAQ. Found something wrong in the product? Tell us — it goes to a person, not a queue.
Read it before you trust it
This describes what the software does today, including the unfinished parts. If a line here is wrong, tell us.