FlowTrade is a trading platform, not a custody venue. This page is the most accurate description we can give of what's actually protected — and what isn't.
Segregated custody, hardened order routing and least-privilege access across every service. Security is designed in from the first commit, not bolted on.
Email and password handled by our managed auth provider. Passwords are hashed (bcrypt) and never visible to us in clear text.
Profiles, wallet, positions and active strategies are scoped to your user id. Every request is filtered by row-level security so users can only ever see or modify their own rows.
Email, display name, trading wallet balance and your active strategies. No KYC, no payment data on the free tier.
The router, the backtest engine and the SQL policies are all public under Apache-2.0. Found a flaw? Open an issue or a PR.
HTTPS everywhere. Edge runtime on Cloudflare Workers. Migration history kept in the repo so auditors can replay schema changes.
Candles, order books and tickers stream from top-tier venue feeds with sub-second consolidation across pairs.
Orders are routed through hardened execution paths with signed request envelopes, tight timeouts and per-account risk limits.
Balance, positions and active strategies are persisted under your user id in our managed database, protected by row-level security.
No KYC, no payment data on the free tier, no third-party trackers or ad networks.