Security

The Publisher EA you download and attach to a chart uses MT5's WebRequestfunction to send data to our server. It does not use, and this integration does not include, any MT5 function that places orders, modifies positions, or transfers funds. There is no "place trade" message anywhere in the data format the EA speaks (see our public Publisher data contract) — this is not a permission we chose to turn off, it is a capability that was never built.

Concretely, the EA only ever reads and reports:

• Account balance, equity, margin and currency.
• Open positions (symbol, side, size, floating profit).
• Closed deals and balance operations (deposits/withdrawals) already recorded by your broker.
• A periodic heartbeat so we can tell you if your connection drops.

Enabling Allow WebRequestfor our domain in MT5's Expert Advisor settings is the only permission the EA asks for. It is not the same as enabling "Algo Trading" permissions for order execution on a signal-copying or trade-copying EA — those don't exist in this integration.

Each connected account gets its own API key, generated only after you pair the EA using a one-time connection code from your account. Every request from the EA is signed with that key using HMAC-SHA256 — the raw key is never transmitted, and a stolen request cannot be replayed against our server for long (requests are time-windowed and checked for replay).

Disconnecting an account (from your Connect page) immediately stops that key from being accepted. There is no way to use an API key to do anything other than submit the read-only account/position/deal data described above.

Every account, trade, and alert is scoped to your own user ID at the database level (Postgres Row-Level Security), not just filtered in application code. Other customers cannot query, list, or infer the existence of your accounts through our API, and our own support access to raw account data is limited to what is needed to answer a support request.

Disconnect the affected account immediately from your Connect page — this revokes its API key. Then reconnect with a fresh one-time code. Because the EA cannot place trades or move funds under any circumstance, the worst case from a leaked key is that someone could see your account's balance and trade history, not trade on it or withdraw from it.

If you believe you've found a security vulnerability in TraceQuant AI, please email us before disclosing it publicly so we can investigate and fix it.

Questions about this page? Email support@tracequantai.com.