Your keys never reach us
You keep the parts that matter. Your keys, your money and the choice to go live stay on your side. This page shows where that line sits, what holds it there, and what we have not built yet.
No absolutes on this page. People write software, and people make mistakes. A page that promises otherwise is claiming something it cannot know.
01
Broker keys stay on your machine
They go into your computer's own secret store. They are never transmitted to us. There is nowhere on our side for them to land, even if we wanted one.
02
The hosted side refuses them
Not by policy. By code. Our servers store METADATA only. Send them a secret-shaped field and the request comes back as an error that says so.
03
Every order passes one choke point
Every order runs the same risk checks first, paper or live, wherever you sent it from. There is no path around them.
04
Stopping is always allowed
The kill switch stops every order. It works from anywhere, with no licence check and no confirmation step. Switching it back off is what needs your licence.
What stays on your machine
The hosted platform is the part that runs on our servers. It does the research work: building strategies, backtesting, validation, paper trading and your history. It holds no broker keys. It sends nothing to a broker. And nothing there can arm live trading, because that route was never built.
The PTQ OS runs on your own computer. Broker keys, live orders and the arm step live there, and nowhere else. Anything on your machine that touches a key refuses callers from outside that machine. That includes our own website, which we allow for everything else.
One thing crosses the line, and it comes inward: a signed licence lease. Nothing crosses the other way. Not your keys, not the power to place an order, not anything on your machine.
Where your keys live
You type your broker keys on your own machine. PTQ hands them straight to the secret store your operating system already runs. It passes them over standard input, not on a command line, because other programs on your computer can read a command line. The keys are never written to a log, and no status check ever shows them.
| Platform | Where the secret sits | Status, honestly |
|---|---|---|
| macOS | Your login Keychain, written by the system's own tool | Written and read back on real hardware |
| Windows | DPAPI, current-user scope | Built to spec. We have no Windows machine here to test it on yet |
| Linux | The Secret Service, if a keyring is installed | Built to spec. We have no Linux machine here to test it on yet |
| Fallback | A file in your PTQ folder that only your user can read or write (mode 600) | Used only when no OS store answers. PTQ tells you when it happens |
PTQ tells you where a key actually landed, not where it hoped to put it. If the OS store was unavailable and it had to use the file instead, the status says so.
We will not even accept them
A promise not to store your keys is worth less than a server that will not take them. Ours holds metadata only: which broker, the label you gave it, what the key is allowed to do, and a short mask. Send it a field named like a secret and the request is refused before anything is written:
“this service stores credential METADATA only. Never send the secret itself. Keys stay on your machine.”
That is the exact response the service returns, word for word, not a paraphrase of an intention. The same service rejects a mask that looks like a real key. And it accepts only data and trading permissions, never withdrawal.
How your licence works
Your licence is not a code the software checks against itself. It is a lease your device collects from our server. The parts that matter all sit on our side.
Signed on our server
We sign every lease with an Ed25519 key that exists only on our server. Your device checks that signature, and the expiry date, every time. Edit a lease and it stops working.
One device, a few days
A lease covers one device and runs out in days. To keep working, it has to be renewed by a server that is allowed to say no. Seats are counted there too.
Credits counted on our server
Work that costs computing power is charged to a balance our server holds. There is no file on your machine to edit, and a negative charge cannot create credits.
The gate is on by default everywhere. In a released build, no setting can turn it off: the switch that disables it while we are developing is ignored outright. The gate also wraps everything at one point, rather than being added route by route, so anything we build tomorrow is gated the day it exists.
Every order, the same checks
Every order walks the same list of checks, in the same order, before it goes anywhere. Paper or live. From the app, the command line or the Claude connector. It is one piece of code, not the same rule written out in three places, so there is no weaker copy of it somewhere else.
- 01Kill switch: engaged means every order is rejected, full stop.
- 02Your confirmation: an order you have not confirmed never goes out.
- 03Per-trade risk check: block the order, or cut its size before it goes.
- 04Live permission: your risk profile has to allow live at all.
- 05Broker connected: the live path never invents a fill to keep going.
- 06Arm state, plus a one-time token issued on your machine. A request cannot simply claim it.
- 07Simulated prices refused: a live plan sized off a simulated quote stops here.
- 08Slippage limit: if a fresh quote has moved past the limit you set, the order refuses rather than chases it.
- 09Portfolio limits: total exposure, the cap per symbol, open positions, the daily loss halt, the max-drawdown stop, orders per day.
- 10The journal: every fill, every trim and every refusal is written down.
An order that reduces a position you already hold skips the portfolio caps. That is deliberate. A risk limit must never trap you in a trade you are trying to get out of.
One press, everything stops
Pressing the kill switch takes no licence check and no confirmation box. A brake you can be locked out of is not a brake. So this is the one open door in an API that otherwise refuses everything by default. While it is on, every order is rejected at the choke point above. Paper orders too.
Releasing it does go back through the licence gate, because that is the direction that lets more happen. The rest of PTQ leans the same way. Pausing the unattended loop and disarming a strategy are always allowed, and never ask twice. Arming one happens on your machine, on purpose, with a scope and an expiry you set.
Everything, item by item
This is the same list the privacy policy carries. If something is not on it, we do not have it.
Account
Your email, your name if you gave one, and sign-in records. These sit with the company that runs our sign-in.
Strategies
The strategies you create and their configuration, so the product can show you your own work.
Risk profiles
Your risk profile, limits and settings, including the mechanics you have switched on.
Paper trades
Simulated fills, labelled simulated, plus your backtest and validation results.
Usage
Which features you used and when, and the credits you spent. This is the record that keeps metering honest.
Consent record
The jurisdiction you declared and the acknowledgements you ticked, with a timestamp.
Support
Tickets and in-app support conversations, which may be processed by an AI assistant to draft answers.
Payment records
From Stripe: name, email, what you bought, the amount and their identifiers. Card numbers never reach us.
You can export your work, or delete it, and neither sits behind the paywall. A subscription that lapses cannot hold your work hostage. Deleting the account deletes what belongs to it: armed strategies, routines and autopilot records go too, rather than being left behind. This website sets no marketing cookies and runs no advertising trackers. Its analytics use no cookies and count visits in totals only.
Three things we cannot do
Move your money
Your money never comes near us. It sits at your broker, in your name, and the keys you give us cannot withdraw it.
Trade on your behalf
Nothing on the web can arm live trading. That happens on your own machine, with limits and an expiry you set. Change your limits and a strategy that is already armed switches off.
See your broker credentials
They never leave your machine. Never logged, never returned by a status call, never put on a command line.
What we have not done
A security page that lists only strengths is marketing. These are the open items as they stand today, in the same words we use internally.
The download is not signed yet
Code signing needs a developer account we have not set up yet. Until we do, the published checksum is how you check the download is the real one. The install notes say exactly what your computer will warn you about an unsigned build.
Software on your machine is yours to modify
Anyone determined can change software running on their own computer. That is why credits, and the power to switch a licence off, live on our server. A changed copy can spend nothing. And it still cannot place an order without your broker keys.
The live path has never met the venue
The live order path is written, and its refusals are tested. But no order has been sent to a broker in live mode. Paper trading is what we can show working today.
Hosted backtests are not on a licensed data feed
Backtests on your own machine use price bars pulled with your own broker key. That is the arrangement we want. The hosted side has not moved to a licensed data feed yet, and we would rather say so than let you assume it has.
Asked most often
Where exactly are my broker keys stored?
How does the licence check work?
What can PTQ never do?
Is the download signed?
More on the FAQ. Found something wrong in the product? Tell us and it goes to a person, not a queue.
Read it before you trust it
This describes what the software does today, including the unfinished parts. If a line here is wrong, tell us.