Security

How Wise Advice Trades protects exchange credentials and accounts · 27 September 2026

Credential storage

• API keys, secrets, passphrases and OAuth tokens are encrypted with AES-256-GCM before they reach the database. Each value has its own random 96-bit IV and authentication tag, so a tampered record fails to decrypt rather than returning wrong data.
• The encryption key is a 256-bit secret held only in the runtime environment of the server processes; it is not in the code, the database, or any backup of them.
• Credentials are decrypted only in memory, only by the server process placing an order, and only for the duration of that request.
• Removing an exchange connection deletes the encrypted record immediately.

Never in the browser, never in logs

• Keys are submitted once, over HTTPS, to a server action; after that the interface shows only the first and last four characters.
• During one-click WEEX authorisation the PKCE verifier lives in an HttpOnly, Secure, SameSite cookie scoped to the callback path, and the access token, refresh token and issued API key never leave the server.
• Application logs record actions and outcomes, never credential values. No browser-side analytics or third-party scripts run on the site.

Accounts and access

• Passwords are hashed with bcrypt (cost 12). Sessions are HMAC-signed HttpOnly, Secure cookies compared in constant time.
• Sign-in attempts are rate-limited per address and per account.
• Two roles: user and admin. Admin pages and the data-ingest API are gated server-side; the ingest API also requires a bearer token.
• Infrastructure (hosting, database, queue, exchange) is accessed by the operator only, with two-factor authentication on each provider account.

Audit trail

Every sign-in attempt, key added or removed, WEEX authorisation, bot started or stopped and admin call is written to an audit log with the actor, IP address, time and outcome. Every signal received and every order sent, filled, skipped or rejected is kept in an execution ledger. Platform request logs are retained by the hosting providers.

Infrastructure

• All traffic is HTTPS with HSTS; the application sends strict transport, content-type, frame and referrer headers.
• Database (Neon PostgreSQL) and queue (Upstash Redis) connections are TLS-encrypted in transit and encrypted at rest by the provider; the application runs in the same region.
• Vercel provides DDoS mitigation and a web application firewall in front of the site and refuses to deploy framework versions with known vulnerabilities.
• Dependencies are audited on each release.

Monitoring and incidents

• The execution worker verifies exchange connectivity on every start and keeps the webhook warm; failures are logged with their cause.
• If a credential or system is suspected compromised we pause affected bots, revoke keys, rotate secrets and notify affected users by email within 72 hours.
• Security contact: security@wiseadvicetrades.com.

See also the Privacy Policy and Terms of Service.