HomeLocalCloudSecurityDocsPricingFAQContact
Get Early Access
Security First

Security

Our approach to protecting your trading operations and data.

Overview

Security is fundamental to algobanana's design. We build around the principle that automation amplifies both gains and risks. Our security model prioritizes transparency, auditability, and explicit control.

Whether you choose Local or Cloud mode, you maintain control over your execution environment. We provide the guardrails, monitoring, and audit trails—you maintain sovereignty.

Security Principles

Zero Trust Architecture

Every request is authenticated and authorized. No implicit trust.

Transparency First

All actions are logged and auditable. No hidden operations.

Defense in Depth

Multiple layers of security controls and validation.

Minimal Privilege

Access granted only when necessary, revoked when not.

Data You Store (and Don't)

What We Store

  • Execution logs: Alert payloads, rule mappings, order details, broker responses
  • Configuration data: Rules, limits, notification settings
  • Audit trails: Who changed what, when
  • Monitoring data: System health, performance metrics

What We Don't Store

  • Funds: We never custody your capital
  • Private keys (Local mode): Keys remain on your machine
  • Unnecessary PII: We collect only what's required for operation

Key Handling Model

Local Mode

API keys and credentials remain on your machine. algobanana software runs locally and connects directly to your broker.

  • Keys never leave your environment
  • You control access and storage
  • Full custody sovereignty

Cloud Mode

You configure broker connectivity through secure credential management. Credentials are encrypted at rest and in transit.

  • Encrypted credential storage
  • Role-based access control
  • Audit trail for all access

Access Control + Audit Logs

Cloud Control includes role-based access control (RBAC) with granular permissions. Every action—configuration changes, executions, log access—is recorded in immutable audit logs.

Audit logs include:

  • Who performed the action
  • What was changed or executed
  • When it occurred (with precise timestamps)
  • Context (IP, session, request ID)

Logs are searchable, exportable, and retained according to your compliance requirements.

Incident Response

If you discover a security issue or operational incident:

Email: security@algobanana.com

We'll acknowledge within 24 hours and provide updates as we investigate.

Responsible Disclosure

We welcome security researchers to report vulnerabilities responsibly. If you discover a security issue:

  • 1Email security@algobanana.com with details
  • 2Allow us reasonable time to investigate and patch
  • 3Avoid public disclosure until we've addressed the issue

We're committed to acknowledging and crediting researchers who help us improve security.