Security

Your account is a trading account. It is guarded like one.

Two-factor sign-in, encrypted broker credentials, keys you scope and revoke, and a log of what happened on your account and when.

Start free on demo Read the privacy policy

Securityaccount

Two-factor authentication: On
Backup codes left: 7 of 8
API keys: 1 read-only
Last activity: Signed in · 2m ago
Earlier: API key revoked · 1d

Illustration with example activity, not a real account.

In short

How does Jassrox keep a trading account secure?

Jassrox protects accounts with optional authenticator-app two-factor sign-in and single-use backup codes, encrypts the MT5 broker credentials bots use, stores passwords and API keys only as hashes, and records security events in an audit log you can read on your Security page.

Sign-up, sign-in and password resets are also protected against automated abuse.

2FA: Authenticator codes + 8 backup codes
Broker credentials: Encrypted at rest
Passwords: Stored as bcrypt hashes
API keys: Hashed, scoped, revocable
Audit log: Every security event, with IP

Sign-in

How sign-in is protected

Two-factor authentication

Two-factor authentication adds a 6-digit code from an authenticator app to your password. Repeated wrong codes lock further attempts for a while.

Backup codes

Turning on 2FA gives you 8 single-use backup codes. Each works once, is stored only as a hash, and can be regenerated.

Bot protection on forms

Sign-up, password reset, and sign-in after a few failed attempts ask for a Cloudflare Turnstile check. Many failures lock sign-in to that email for a while.

Hashed passwords

Passwords are stored only as bcrypt hashes. Nobody at Jassrox can read your password.

Sign out everywhere

End every session on every device at once. A reused session token is detected and recorded.

Audit log

An audit log is a dated list of security events on your account. Yours is on the Security page, filterable by date.

Broker credentials

How are MT5 broker credentials stored?

Broker credentials are the MT5 login and password a bot uses to trade on your broker account. Jassrox encrypts them before storing them and decrypts them only on its servers when a bot or terminal signs in. They are never displayed back in the app. Jassrox does not hold your funds: it is software connected to your trading login, and deposits and withdrawals stay with your broker.

Connected accountMT5

Server: Broker-Live
Login: ••••4821
Password: encrypted
Withdrawals: not possible from Jassrox

Illustration with example values, not a real account.

Automation access

Keys for agents and alerts

Scoped API keys

Keys for Jassrox Agent are read-only unless you allow live trading when creating them. The full key is shown once and stored as a hash; revoking it cuts access on the next request.

Webhook URLs

Each bot's TradingView webhook has its own secret token, accepts requests only from TradingView's servers, and can be regenerated if it leaks.

Audit log

What the audit log records

The audit log records security events with the time and the request's IP address: sign-ins, failed and blocked sign-ins, 2FA changes, password resets, API keys created and revoked, bots started, stopped, edited and deleted, broker connection requests, and every change made through Jassrox Agent, marked as the agent's.

Recent activity

2fa_enabled: 10:42
api_key_created: 10:45
mcp_start_bot: 11:02
login_failed: 13:17
logout_everywhere: 13:20

Illustration with example events.

Platform

Behind the account

Limited server access

Administrative access to Jassrox servers is reachable only over a private network, not from the open internet.

Your data

What is collected, why, and how long it is kept is set out in the privacy policy.

Plainly

What it does, and what it does not

It does

Offers authenticator-app 2FA with 8 single-use backup codes.
Encrypts MT5 broker credentials and stores passwords and API keys as hashes.
Logs security events and agent actions with time and IP address.
Lets you revoke API keys, rotate webhook URLs and sign out everywhere.

It does not

Hold your deposits or move money in or out of your broker account.
Show your broker password back to anyone, including you.
Offer passkeys or SMS codes yet; 2FA uses an authenticator app.
Protect against losses from trading itself. Leveraged trading can lose money.

FAQ

Questions people ask

All questions

Does Jassrox support two-factor authentication?

Yes. You can turn on two-factor authentication with any authenticator app that supports time-based one-time codes (TOTP). You also get 8 single-use backup codes for when your phone is unavailable, and you can regenerate them at any time.

How does Jassrox store my MT5 password?

Broker credentials are encrypted before they are stored, and are decrypted only on the server when a bot or terminal needs to sign in to your broker. They are never shown back to you or anyone else in the app.

Can Jassrox withdraw money from my broker account?

No. Jassrox is trading software connected to your MT5 trading login. It is not a broker and does not hold your deposits; deposits and withdrawals stay between you and your broker.

What does the audit log record?

Sign-ins and failed sign-in attempts, 2FA being turned on or off, password resets, API keys created or revoked, bots started, stopped, edited or deleted, broker connection requests, and every change made through Jassrox Agent, each with a time and the request's IP address.

What if I think someone else has my login?

Reset your password, use sign out everywhere to end every session, turn on two-factor authentication, revoke any API keys you do not recognise, and check the audit log for activity you did not do.

Keep exploring

Agent & APIConnect AI agents with scoped API keys

TradingView alertsStart and stop bots from TradingView webhooks

Risk managementLoss budgets, drawdown limits and exposure caps

Privacy PolicyWhat we collect and why

Alerts & notificationsErrors, auto-pauses and drawdown stops

Start on demo

Set it up safely from day one.

Create an account, turn on two-factor authentication, and try bots on virtual funds before connecting a live broker account.

Start free on demo See pricing

$10,000 virtual funds · No card required