Security & Trust

Tradewink handles your broker API keys and executes real trades on your behalf. We take that responsibility seriously. Here's exactly how we protect your data and your money.

In short: your broker API keys are encrypted at rest with Fernet (AES-128-CBC) using PBKDF2-derived keys, never stored or logged in plaintext, and decrypted only transiently in memory. Authentication runs on Clerk-issued RS256 JWTs verified against rotating JWKS keys, and all API and WebSocket traffic is encrypted in transit over TLS. Tradewink is non-custodial — it can place orders but can never withdraw your funds.

Encrypted at Rest
Encrypted in Transit
23,000+ Tests
Audit Logged

Broker Key Encryption

Your broker API keys are encrypted at rest using Fernet symmetric encryption with PBKDF2-derived keys.

  • AES-128-CBC encryption via Fernet (Python cryptography library)
  • PBKDF2-HMAC-SHA256 key derivation with 600,000 iterations
  • New key records are encrypted with a unique random salt per record; older records that used a shared static salt are being re-encrypted
  • Keys are never persisted in plaintext in the database or logs
  • Decryption happens transiently in application memory only when needed for broker API communication

Data Protection

All data in transit and at rest is encrypted using industry-standard protocols.

  • TLS for all API and WebSocket connections, terminated at the Fly.io edge
  • PostgreSQL database hosted on Neon with encryption at rest (AES-256)
  • Redis cache encrypted in transit via TLS
  • No sensitive data in application logs — structlog SanitizingProcessor strips API keys, tokens, and secrets
  • Discord bot token and all service credentials stored as encrypted Fly.io secrets

Infrastructure

Production infrastructure runs on isolated, hardened cloud services.

  • Fly.io hosting on isolated Firecracker microVMs, not shared containers
  • Neon Serverless Postgres with automatic backups and point-in-time recovery
  • Sentry error tracking with PII scrubbing enabled
  • Axiom log aggregation with no sensitive data forwarded
  • Automated deployments via Buildkite CI/CD with isolated build environments
  • Static egress IP for broker connections — predictable, whitelistable

Access Controls

Multi-layered access controls protect every level of the system.

  • Clerk authentication with RS256 JWT tokens, verified against rotating JWKS keys
  • JWKS-based token verification — no shared secrets between services
  • Role-based access control for admin vs. user operations
  • Per-user data isolation — each user can only access their own keys, strategies, and trades
  • Rate limiting on authentication, key-submission, and service API endpoints
  • CORS restricted to tradewink.com origins for authenticated endpoints (public read-only API excepted)

Trading Safety

Multiple layers of protection prevent runaway trading and unauthorized executions.

  • Auto-execution off by default — trades require explicit confirmation until you enable autonomous mode
  • Paper mode is the default for simulated testing before going live
  • Daily loss limits and circuit breakers halt trading during drawdowns
  • Maximum open position limits and sector concentration checks
  • Internal day-trade (Pattern Day Trader style) round-trip guard helps you avoid your broker's day-trading restrictions
  • Audit logging for every trade action — entry, exit, fill, cancellation, and rejection
  • Per-user broker resolution — your keys are never mixed with another user's

Network Security

Network-level protections guard against unauthorized access and attacks.

  • Fly.io edge TLS termination with automatic certificate management
  • No publicly exposed database ports — database access over TLS to a managed Postgres provider
  • Webhook signature verification (HMAC-SHA256) for all inbound webhooks — fail-closed when a secret is unset
  • IP-based access control for broker gateway connections (static egress IP)

Code Quality & Testing

Rigorous testing and code quality practices reduce the risk of security vulnerabilities.

  • 23,000+ test functions across 500+ test files
  • CI test suite runs against PostgreSQL (SQLite supported for local development)
  • Ruff linting and formatting enforced on every CI run
  • Type checking on critical trading paths (ty check)
  • Config-to-schema field mappings validated at CI time
  • Automated dependency vulnerability scanning in CI (pip-audit)

Read the Code

Security claims are cheap. Code is not.

The Tradewink codebase is MIT-licensed — roughly 360,000 lines of Python with 23,000+ test functions. The repository is currently private, so we will not pretend you can click through to it today: it is source-available on request. Email [email protected] to request review access. These are the exact files we point reviewers to first:

Per-user broker key encryption

tradewink/trading/user_keys.py

Fernet (AES-128-CBC) encryption with PBKDF2-HMAC-SHA256 key derivation and a unique random salt per stored record. Records written before per-record salts were introduced used a shared static salt and are being re-encrypted to the per-record format. This is the file that decides whether your broker keys are safe.

Risk circuit breakers

tradewink/trading/risk_manager.py

Daily loss limits, maximum open position limits, sector concentration checks, the circuit breaker that halts trading during drawdowns, and the day-trade round-trip guard.

Position sizing

tradewink/trading/position_sizer.py

Risk-based, ATR-based, and half-Kelly sizing where the most conservative answer wins — the discipline layer that decides how much of your account a single trade can touch.

Research methodology

docs/research/algo-improvement-research-prompt.md

The working document behind our improvement loop: every strategy change ships behind a default-off feature flag, bug fixes require a regression test, and no merge may change live trading behavior until it has been validated.

Why this matters: Tradewink is non-custodial by architecture, not by promise — the code that encrypts your keys, caps your risk, and sizes your positions is specific, inspectable Python, and we would rather show it to you than ask you to take a comparison table on faith. Honest system history lives on our status page, including full incident writeups.

Security & Trust FAQ

How are my broker API keys stored?+

Your broker API keys are encrypted at rest using Fernet symmetric encryption (AES-128-CBC) with PBKDF2-HMAC-SHA256 key derivation at 600,000 iterations and a unique random salt per stored record. Records created before per-record salts were introduced were encrypted with a shared static salt and are being re-encrypted to the per-record format. Keys are never persisted in plaintext in the database or logs, and are decrypted only transiently in application memory when needed for broker API communication.

Can Tradewink withdraw my funds?+

No. Tradewink only sends trade orders through your broker's API — it has no custody of your money and no ability to withdraw it. Per-user broker resolution means your keys are never mixed with another user's, and each user can only access their own keys, strategies, and trades.

What encryption does Tradewink use?+

Broker keys use Fernet (AES-128-CBC) with PBKDF2-HMAC-SHA256 key derivation. All data in transit is protected with TLS for every API and WebSocket connection, terminated at the Fly.io edge. The PostgreSQL database on Neon is encrypted at rest with AES-256, and the Redis cache is encrypted in transit via TLS.

How does Tradewink authenticate users?+

Tradewink uses Clerk authentication with RS256 JWT tokens verified against rotating JWKS keys, with no shared secrets between services. Role-based access control separates admin and user operations, and rate limiting is applied to authentication, key-submission, and service API endpoints.

What stops the system from runaway trading?+

Auto-execution is off by default, paper mode is the default for testing, and daily loss limits plus circuit breakers halt trading during drawdowns. Maximum open position limits, sector concentration checks, and day-trade limit enforcement add further guardrails, and every trade action is audit logged.

Can I audit Tradewink's source code?+

The Tradewink codebase is MIT-licensed. The repository is currently private, so it is source-available on request rather than fully public — email [email protected] to request review access. The files we point reviewers to first are the per-user broker key encryption (tradewink/trading/user_keys.py), the risk circuit breakers (tradewink/trading/risk_manager.py), and position sizing (tradewink/trading/position_sizer.py).

Responsible Disclosure

If you discover a security vulnerability in Tradewink, please report it responsibly. Email [email protected] with details and we will respond within 48 hours. Please do not publicly disclose the vulnerability until we have had an opportunity to address it. We appreciate security researchers who help us keep our users safe.

Start Trading Securely

Your broker keys are encrypted from the moment you enter them. Free to start, no credit card needed.

Get Started Free