Security

Cloud9Trader holds your broker keys and runs your code, so this page says plainly what protects them today, and what does not exist yet.

Your sign-in

• Passwords are hashed with bcrypt before they are stored. Nobody at Cloud9Trader can read your password.
• A wrong username and a wrong password give the same message, so the sign-in screen does not reveal which accounts exist.
• Sessions use signed cookies sent only over HTTPS. A session lasts until 24 days after you last used it, and never longer than 30 days after you signed in. Signing out ends it on every server at once.
• Changing your password sends you an email, so you know if someone else did it, and signs out every other browser where you were signed in.

Your broker keys and API secrets

• Broker and exchange keys are encrypted before they are written to the database, and the encryption key is not stored in the database. After you save a key, Cloud9Trader never shows it to you or anyone else again.
• Your algorithms never see your keys. Your code asks to open or close a position; Cloud9Trader makes the call to your broker.
• Cloud9Trader API secrets are shown once, when you create the key, and stored encrypted. Revoke a key in API Access at any time. See Authentication and keys.
• Card payments go through Stripe. Cloud9Trader never receives or stores your card number.

Give every exchange key the least it needs: trading on, withdrawals off. See Brokers.

Your code

• Your algorithms and indicators are checked before they run. Code that tries to load the server’s own modules, or to reach its files or process, is refused.
• Your code runs on Cloud9Trader’s servers, in shared processes, not in a separate container of its own. Stronger isolation for each trading session is being built, and this page will say when it is in place.
• Your code is private unless you share it. See Sharing algorithms.

Not available yet

• Two-factor authentication.
• A list of your signed-in sessions, or signing out of one browser from another.

Report a vulnerability

If you find a security problem in Cloud9Trader, email security@cloud9trader.com. If that address ever bounces, use support@cloud9trader.com with Security in the subject. The same addresses are published at /.well-known/security.txt.

Tell us what you found and how to reproduce it. We will:

• Answer within 5 working days, saying whether we can reproduce it.
• Keep you told while we fix it, and say when it is fixed.
• Credit you when we describe the fix, if you would like that.

What we ask of you:

• Test only against your own account, with your own broker practice or demo accounts. Never touch another person’s account or data, and never place orders on a live account other than your own.
• Do not degrade the service for others: no denial-of-service testing, no automated scanning that floods the site.
• Stop and tell us as soon as you reach data that is not yours, and do not keep it.
• Give us 90 days to fix it before telling anyone else, or less if we tell you it is fixed sooner.

If you research in good faith and keep to these rules, we will not take legal action against you or report you to law enforcement for that research.

Read next

• Privacy: what the docs site and the app collect.
• Risk warning: the risks of trading with Cloud9Trader.