Security at TradeZournal

Your journal, strategies and account connections are sensitive. This page describes how we protect them, and what you can do to help.

• Passwords are stored only as salted hashes, never in plain text.
• You can sign in with Google instead of a password.
• Sessions use secure, HTTP-only cookies that scripts on a page cannot read, and requests are rate limited to slow guessing and abuse.
• Everything you create is visible only to your account. Other members, and unauthenticated visitors, cannot read it.

• Credentials are checked with the broker, then stored encrypted. They are decrypted only on our servers and only to read your account.
• They are never displayed again or sent back to your browser.
• TradeZournal reads your trades, holdings, balance and equity, and every read is logged on your account.
• A MetaTrader investor password is passed to our connection provider once and never stored by us. Disconnecting an account deletes it there too.

Use your read-only investor password for MetaTrader. It can look at your account but cannot trade.

• Traffic is encrypted in transit.
• Secrets such as the encryption key are kept in configuration, not in the code.
• Documentation and diagnostic endpoints are restricted to administrators.
• Strategy scripts run in an isolated sandbox with no network access.

• Use a long, unique password, or sign in with Google.
• Where a broker lets you, use keys that allow only what you need, and revoke them in the broker if you stop using TradeZournal.
• Use the read-only investor password for MetaTrader.
• Keep your email account secure: it is how you recover yours.

If you find a security problem, please tell us privately before sharing it publicly, and give us a reasonable time to fix it. Send the details, and how to reproduce it, to [email protected]. Please do not access other people's data or disrupt the service while testing.

Last updated October 2026.