Security and infrastructure
How SwiftTrade protects accounts, keys and data, where it runs, and what it does not claim. Taken from the code and the project's own documents.
Accounts, keys and the order path
A trading tool is only worth the trust you can put in it. These are the rules SwiftTrade is built on — when something is uncertain, it stops instead of guessing.
- Accounts
- Passwords are stored as memory-hard scrypt hashes. Two-factor sign-in with an authenticator app and recovery codes; every session is listed and can be signed out.
- Broker keys
- API keys are encrypted on the server (AES-256-GCM) and never sent back to the browser — you only ever see the last four characters. Keys that can withdraw funds are refused for live accounts.
- Live trading, locked
- SwiftTrade starts in paper mode. Live execution needs the operator's server switch and a typed confirmation for each session, and the emergency stop is always one click away.
- AI explains, never trades
- The co-pilot and the news engine can inform you and can lower risk. Neither can place an order.
- An audit trail
- Sign-ins, security changes, broker connections and every change of the trading bot's mode are written to an append-only, hash-chained log.
Where SwiftTrade runs
How the server is built, how the website loads, and what the desktop workstation will do on your own computer.
- One server process
- A single Python process (FastAPI) serves this website, the web terminal and the API. The release runs it in a container behind Caddy, which obtains the HTTPS certificates, redirects plain HTTP and keeps cookies and authorisation headers out of its access log.
- Everything from one origin
- The website's content security policy allows scripts, styles, pictures and connections only from SwiftTrade's own address. There are no third-party scripts, fonts or trackers on the page.
- The desktop workstation
- When it is released, the Windows workstation runs its own engine on your computer: charts, orders, strategies and risk work without the server, and the connection to an account is optional.
- When in doubt, stop
- Stale or missing data, an unverified broker connection or a failed check stops the order path instead of guessing. An emergency stop halts new orders; it does not close open positions on its own.
The design of the hosting is described here as it is in the repository; the live servers are not audited by a third party.
Your data on this website
- Analytics only if you agree
- Nothing is measured until you switch analytics on in the cookie settings, and a browser that sends Do Not Track or Global Privacy Control is never measured. There is no advertising or marketing tracking.
- What this website stores
- Your choices of language, region and appearance, kept in your own browser. Signing in sets a session cookie for your account.
What SwiftTrade does not claim
- No security certification, external audit or regulatory licence. None has been obtained, so none is shown.
- SwiftTrade is neither a bank nor a broker, holds no client money and gives no investment advice.
- Trading with real money is switched off on the public service.
- The legal documents are drafts that have not yet been legally reviewed; each one says so until it is published.
- SwiftTrade is not affiliated with SWIFT, the financial messaging network.
Found a problem?
Tell us through the contact page and describe what you found. Please do not test against other people's accounts.