Encrypted keys, secure sign in, and controls you manage.
Tradeify protects your sign-in and your broker keys. Your money stays at your broker. We protect the software.
Alpaca API keys are encrypted at rest with AES-256-GCM before we store them. You can disconnect the broker from broker settings, which removes the saved connection.
The site is served over HTTPS, so traffic between your browser and Tradeify is encrypted.
An authenticator app code is required for every account, including Google sign in. That extra code is how we confirm it is you.
Your sign-in expires and refreshes on its own. The session does not hold your password.
We store a scrambled version of your password. We never store the password itself.
The app runs on managed servers, with a separate database and locked storage.
Here is how we keep your account secure from sign-up through each visit.
We store a scrambled version of your password. You confirm your email before a paid plan.
We check your email and password on our servers. A successful sign-in expires on its own.
You paste Alpaca API keys into the app. We encrypt them with AES-256-GCM before we store them. Disconnect the broker in settings when you want those keys removed.
We check your sign-in on every request. When it expires, we ask you to sign in again.
Read our Privacy Policy for details on how we handle your data.