Security at CopyPilotFlow
You connect trading accounts to this software, so you deserve specifics — not slogans. Everything below describes controls that are actually implemented in the product today. We don't claim certifications we don't hold.
Credential encryption
Broker credentials and tokens are encrypted at rest with AES-256-GCM (random IV, authenticated tag) using a dedicated key that is validated at boot. Ciphertext is never returned to the browser or any API response — decryption happens only in-process, at the moment a broker call is made.
Authentication & sessions
Passwords are hashed with bcrypt (cost 12) and compared in constant time. API access uses short-lived JWTs backed by server-side session records, so signing out revokes access immediately — on both the REST API and the live WebSocket feed. Email verification and expiring password-reset tokens are built in; completing a reset invalidates all sessions.
Authorization
Every account, group, connection and cockpit operation checks ownership on the server. One user can never read or act on another user’s accounts, and plan limits are enforced server-side rather than in the UI.
Hardened API surface
All input is schema-validated. Security headers are applied via Helmet, CORS is locked to the application origin, and rate limits protect the whole API (100 requests/minute per IP) with tighter limits on login, registration and password-reset endpoints. Production refuses to boot with placeholder secrets.
Webhook security
Stripe billing webhooks are verified against their cryptographic signature using the raw request body. TradingView alert webhooks use an unguessable per-group secret URL — and only a SHA-256 hash of that secret is stored in the database.
Audit trail
Sign-ins, connections, risk-rule changes, every copied or rejected order, flattens, emergency stops and billing events are written to a persistent audit log with actor, action, metadata and IP. You can review your own audit history inside the app.
Fail-safe execution
Orders are only placed over live, authenticated broker sessions. Duplicate protection is enforced at three layers (database constraints, queue job IDs and broker client-order IDs), a circuit breaker stops hammering a failing connection, and reconciliation never opens new exposure — it only alerts or flattens.
Live-trading gate
Demo and live are separated at the infrastructure level: live broker connections are refused entirely unless the server deployment itself is explicitly switched to the live trading environment. The default environment is demo.
Security questions
Can CopyPilotFlow withdraw funds from my broker account?
No. Broker connections are used for trading operations only — placing, modifying and flattening orders, and reading positions and fills. There is no withdrawal or transfer capability anywhere in the system.
Does CopyPilotFlow store my broker password?
If you connect via OAuth (where the broker supports it), no password is ever seen — only revocable tokens. If you connect with broker credentials, they are stored encrypted with AES-256-GCM, are never returned to the browser, and are decrypted only in server memory at the moment a broker call is made.
What happens if a broker connection drops?
No orders are placed over a dead session. The adapter reconnects with exponential backoff, connection state is shown in the cockpit, and any position drift that accumulated while offline is surfaced by the reconciliation watchdog.
What happens if CopyPilotFlow itself goes offline?
The system fails safe: no new follower orders are placed while the service is unreachable. Your positions live at your broker, not with us — which is why we recommend always keeping direct broker access available. Active groups resume their subscriptions automatically when the service restarts.
Do you offer two-factor authentication?
Not yet. Today you can secure your account with a strong password or Google sign-in (verified ID tokens). Sessions are individually revocable server-side, and password resets invalidate every active session.
Found a vulnerability? We want to know. Report it responsibly via the support channel inside the app and we will prioritize it.