Account and broker access
- Read-only by design
- Broker adapters use read endpoints. Hosted MetaTrader connections require an investor password, which cannot open, modify or close a position.
- Encrypted credentials
- Stored broker credentials are encrypted. The encryption key and the database must be kept together in a recovery plan; encrypted provider credentials cannot be recovered without their key.
- Server-side sessions
- The application uses email verification and server-side sessions. The website is served over HTTPS with HSTS.
- Explicit AI consent
- No account data reaches OpenAI until you consent. The journal and analytics work without it.
Rules that protect you from us
Use the connection form inside Orderblock. Never send a broker password to support, and never enter your email account password into Orderblock. Anyone asking you to do either, including someone claiming to be us, is not us.
Payment card details are handled by Stripe’s hosted checkout and customer portal. Orderblock receives subscription state, not card numbers.
Reporting a security concern
Email [email protected]
Include the affected URL, the time, and a description of what you observed.
Leave secrets out of the report
Do not include passwords, session cookies, API keys or customer data.
If your browser or ISP shows a warning
Send us the provider name and the exact message. Do not disable your security tools to reach the site.