Trust is architecture,
not a promise.
You are routing your trading through us — you should demand a precise answer to what that exposes. Here it is, starting with the things we made impossible rather than merely forbidden.
What we can never see or do.
Not policy. Architecture. These are absent from the system, not protected inside it.
How the rest is protected.
Encryption everywhere
TLS for every connection in transit; encryption at rest for every store that touches your data.
Reduction-only enforcement
The enforcement service holds the narrowest possible authority: it can only ever decrease your exposure. Widening that authority requires changing the architecture, not a config flag.
Isolated environments
Production is isolated from staging and development; access is role-restricted, short-lived, and logged.
Immutable audit trail
Every enforcement event is recorded with rule, symbol, size, and latency. The audit trail in your console is the same one we debug from — there is no second set of books.
Non-loosening API
During a locked session, loosening a rule is rejected at the API layer. There is no request that works, which also means there is nothing for an attacker to replay.
Least-data design
We keep what the console needs to show you and nothing speculative. The full inventory is four items long — see the privacy policy.
Found a hole anyway? security@tradepanda.app goes straight to engineering. We pay for good reports, we answer fast, and we credit researchers who want it. Please do not test against accounts you do not own.
The paranoid design is the point.
A product whose whole job is stopping you at your worst had better be harder on itself.
Draw the line — $14.99 →14 DAYS · THEN $29.99/MO · CANCEL ANYTIME