Skip to content
Trust

Security

Your security is our top priority.

Our Security Commitment

Your bot runs on servers we operate, using credentials you give it. This page says plainly what we hold, how it is protected, and what the bot can and cannot do with it.

Encrypted Credentials

AES-256 at rest, TLS in transit

No Custody

Your money stays with your broker

Isolated Bots

One bot, one terminal, one folder each

Health Monitoring

Every server reports continuously

Your Money

We never hold, receive or move your trading funds. They stay in your account at your broker. The bot uses your MetaTrader 5 login to place and manage trades, and nothing else.

MetaTrader has no way to withdraw money: deposits and withdrawals are made in your broker's own client area, with a separate password that we never ask for. Do not give that password to anyone claiming to be us.

Your Trading and Telegram Credentials

To trade for you, the bot needs your MetaTrader 5 login details and a sign-in to your own Telegram account.

  • Encrypted at rest: your MetaTrader password, your Telegram API hash and your Telegram sign-in are stored encrypted with AES-256, each locked to your own bot.
  • Never shown back: once saved, the app displays them masked. Nobody can read them out of the app, including you.
  • Not kept on your computer: the app stores no trading or Telegram credentials on your PC, only an encrypted sign-in token for your CAEAutomations account.
  • Used only by your bot: on the server, they are given to your bot's own processes and to nothing else.

We recommend a MetaTrader account used only for this bot, and changing its trading password if you stop using the service.

Separation Between Customers

A server runs bots for several customers, but each bot is its own set of processes with its own MetaTrader terminal, its own files and its own Telegram connection. One customer's bot is never given another customer's settings, credentials, signals or logs, and the app can only ever see and control the bots that belong to the account signed in to it; that is checked on our servers for every request.

Your Account

  • Password: stored only as a salted hash. We cannot read it.
  • Activation and reset: by a one-time code sent to your email address, valid for a few minutes.
  • Sign-in attempts: limited, and an account is locked temporarily after repeated failures.
  • Changing your password signs every device out.

Data Encryption

Everything sent between the app, this website and our servers travels over TLS-encrypted connections. The app refuses to connect if the connection is not authentic, including on networks that try to inspect it.

Payment Security

Payments are made by MMG (Mobile Money Guyana) or by cryptocurrency through NOWPayments. We never see, receive or store card details. From a payment we keep its reference, amount and status.

Report a Vulnerability

If you discover a security vulnerability, please report it to:

Email: support@caeautomations.com