Security
What stays on your computer, and what we hold.
The design starts from one rule: the thing that can spend money lives on your machine, and the thing we run in the cloud cannot spend it. Everything below follows from that. This page is written for someone deciding whether to trust us with a brokerage connection; if a claim here is unclear, write to us and we will explain it.
What we hold
- Your email address and password hash
- Devices that signed in and when
- Subscription status and Stripe customer id
- Which legal documents you accepted and when
- Crash reports, only if you switched them on, with identifying details removed
What we never hold
- Broker usernames, passwords, tokens or API keys
- Your positions, orders, fills or account values
- Market-data keys
- Card numbers
- The contents of the research chat on your desk
The controls
Specifically.
| Area | What is in place | What it means for you |
|---|---|---|
| Passwords | Argon2id hashing, minimum 12 characters, checked against known breaches | A stolen database does not give up passwords; a leaked password from elsewhere is refused. |
| Sessions | Short-lived signed access tokens; rotating refresh tokens in families, bound to one device | A copied token dies in minutes. A replayed refresh token kills the whole family and emails you. |
| Two-step sign-in | TOTP with recovery codes; required for our staff, offered to everyone | A password alone does not open your account. A reset with two-step on needs a recovery code. |
| Devices | One active seat per subscription; taking the seat shows what the other device is doing | Nobody can silently start trading from a second machine on your account. |
| Broker credentials | Kept only on your computer in Windows Credential Manager; never sent to us | Our servers cannot place an order at your broker. A breach of our servers cannot reach your account. |
| Orders | Every entry carries a stop and a target held at the broker; four code paths can originate an order and each checks the entitlement, the arm phrase and the kill switch | A laptop that sleeps leaves nothing unprotected, and nothing in chat, email or the website can buy or sell. |
| Kill switch | In the app, by email link, by an independent watchdog on your computer, and by us server-side | A desk that goes silent is disarmed; a compromised account can be stopped from our side within minutes. |
| Updates | Signed with a key baked into the app; refused while armed or holding a position | No one can push code to your desk that we did not sign, and never mid-trade. |
| Payments | Card details entered on Stripe's pages; we hold a customer id and a status | We never see or store a card number. |
| Web pages | Strict content-security policy on every page, including a nonce-pinned admin console; HSTS; no third-party scripts | An injected string on any of our pages renders as text and cannot run. |
| Logs | Structured logs with a redaction pass tested in CI; crash reports opt-in and scrubbed twice | Secrets, addresses and account numbers do not end up in a log line. |
| Audit | Every sign-in, device change, billing event and staff action leaves an audit row; staff need a separate credential from an allowed address | Anything done to your account can be traced, including by us. |
Reporting a vulnerability
Write to security@doyel-labs.com. Tell us what you found and how to reproduce it. We answer within two business days, fix confirmed issues before disclosing them, and credit reporters who want it. Please do not test against other people's accounts or data. The machine-readable policy is at /.well-known/security.txt.
If your account is compromised
Sign out everywhere from the app, change your password, turn on two-step sign-in, and review your brokerage account directly. The steps are on the account security page. Your broker credentials were never on our servers, so a breach on our side cannot reach your brokerage account.
Security changes
What we fixed, and when.
- 2026-09-06Fixed a Windows liveness check in the desk lock that could terminate an unrelated process; the lock now records the holder's start time so a reused process id is never mistaken for the old engine.
- 2026-09-06Admin console shipped with a per-request nonce content-security policy and an address allowlist that applies before a token is typed.
- 2026-09-06Cross-origin access to the API limited to this site's origins, GET and POST only, no credentials.
- 2026-09-06Mail-provider failures now surface to the person instead of leaving a half-made account.
Live service health is on the status page.