Security

You are handing us access to an account with money in it. Here is exactly what we hold, what we cannot hold, and what happens when something breaks.

Your broker password

We never see it. When you connect an account, your browser encrypts the password to a public key belonging to your server, using a sealed box. The sealed value travels through us and is stored, but the private key that opens it only ever exists on your server.

Opening it takes two parties: your server holds the private key, and we hold an unwrap key that the server must ask us for. Neither side alone can read the password. If our database leaks, the sealed credentials in it are inert. If your server is seized, it still has to reach us to start.

API keys

Shown once, at creation, and stored only as a hash. We cannot show you a key again because we do not have it — if you lose one, the honest answer is to create another and revoke the old one, which is what the dashboard offers.

Keys carry a scope, and the scopes are deliberately narrow:

• read — prices, positions, history. Cannot place an order.
• trade — everything above, plus orders. Cannot mint keys, change limits, or touch your account settings.
• manage — account and key administration. Cannot place a trade.

A trading key cannot escalate itself, and the dashboard session is a manage credential — so a compromised browser session cannot open a position.

Limits are enforced before the broker

Largest order size and maximum open positions are checked on our side, on every request, before anything reaches your broker. A key with a mistake in it — or in the hands of someone else — is bounded by numbers you set, not by how fast you notice.

The kill switch

One control, on every page of the dashboard, that stops new exposure immediately. Closing positions and cancelling orders keep working while it is engaged, because the invariant we hold to is that exposure-reducing calls always work — through the kill switch, through rate limits, through a lapsed subscription.

Isolation

Each MT5 account runs in its own container, with its own terminal, its own data directory and its own credentials. Accounts do not share a process, and one account’s terminal hanging does not touch another’s.

What we log

Every request that changed something, with the key prefix that did it, the outcome, and how long the broker took. We do not log passwords, full keys, or order payloads beyond what the activity page shows you. You can export the log from the dashboard at any time.

Reporting a vulnerability

Mail security@vestro.io. Tell us what you found and how to reproduce it. We will confirm receipt, and we will not pursue anyone acting in good faith who gives us a reasonable window before disclosing.