TradeCopier Security
Account Access & Connection Checks

Review account access, credential handling, trading permissions and connection status for your selected setup. Confirm the current controls with support before connecting a live account.

Credential Handling

Read the reviewed password and connector storage details below, then confirm deployment-specific access and revocation controls.

API And Platform Access

Confirm the current API reference and permitted actions for the plan and platform you use.

Sign-In Controls

Signup includes WhatsApp and email verification in the reviewed implementation. Confirm the protections available for subsequent sign-in.

Connection Review

Review account events and compare source and follower positions after an interruption.

Security Details

Review Your TradeCopier Account Connection

Check authentication, permissions, connection status and recovery steps before enabling live copying.

C

Check Access Before Connecting

Review the account connection method, permitted actions and any connector that must remain online before enabling copying.

Copying does not require withdrawal permission. Verify the access granted by your broker or platform for the intended setup.

A

Account And API Access

The implementation reviewed on October 2, 2026 uses signed-in user bearer authentication for the documented TradeLocker and cTrader account endpoints. Those handlers resolve account ownership before account operations. This source review is not an independent security audit or a test of deployed permissions.

  • Sign-in: The reviewed signup flow verifies WhatsApp and email before marking registration complete. This is registration verification; it does not establish multi-factor authentication at every login.
  • API access: Send API credentials through the authorized client, never in public reports. Confirm the current endpoint contract and subscription access before integration.
  • Access review: TradeLocker disconnect and delete are separate actions in the reviewed API. Disconnect stops the app session and marks the account disconnected; deletion removes the app account record. For provider-side credential revocation, use the broker or platform controls and reconcile open positions separately.
C

Connection And Service Status

The hosted router and the broker or platform connection are separate parts of a copying workflow. Check connection events in your account dashboard when a trade is not copied as expected.

After an interruption, compare source and follower positions and review activity logs. Confirm whether missed instructions are replayed for your setup before resuming live copying.

B

Broker Account Safety

TradeCopier does not need withdrawal permissions to copy trades. Confirm that your selected broker or platform connection grants only the trading and account actions required for your intended workflow.

The reviewed source hashes dashboard passwords with salted PBKDF2-SHA256 and defines AES-GCM encryption for MT5 credential writes and TradeLocker passwords and session tokens. This describes those code paths only: deployment configuration, encryption-key administration, historical stored records and other connectors were not inspected. It is not a claim that every stored field or backup has been independently verified as encrypted.

R

Responsible Disclosure

If you believe you have found a security issue affecting TradeCopier, please contact our support team with a clear description of the finding, steps to reproduce it, and any relevant technical details.

Security contact: Send security reports through the TradeCopier contact form or email support@tradecopier.org.

Start Copying Smarter Today

Connect supported accounts with configurable sizing, risk controls, activity logs, and alerts.

Get Started Free