What we protect,
and what we never touch.
ONYX connects to live market data and, if you choose, to your own brokerage. This page states the mechanisms in plain terms rather than showing you a badge.
What ONYX is not
We are not a broker-dealer or an investment adviser
ONYX does not provide investment advice or recommendations. Brokerage services, order routing and execution are provided by your own connected third-party broker.
We never hold your money
There is no ONYX account balance, no custody and no transfers. Funds stay with your broker. Connecting a brokerage authorises ONYX to act through their API — it does not move anything to us.
Paper trading is the default
New accounts trade against a simulated ledger. Live execution is something you turn on deliberately, per portfolio — never a default and never a surprise.
Getting into your account
Passkeys
You can sign in with Touch ID, Face ID, Windows Hello or a hardware security key instead of a password. The private key never leaves your device and there is no shared secret for us to lose.
Two-factor authentication (TOTP)
Authenticator-app two-factor is supported. Only a fully verified factor gates sign-in, so an abandoned half-finished enrolment can never lock you out of your own account.
Automatic lockout on repeated failures
Failed sign-in attempts are recorded and an address is locked out after repeated failures, which is what makes password guessing impractical rather than merely slow.
Bot protection
Sign-up, sign-in and password reset are protected by Cloudflare Turnstile, verified on the server — not just in the browser, where it could be skipped.
Your brokerage and API keys
Secrets are encrypted at rest with AES-256-GCM
Broker tokens and connection secrets are encrypted with AES-256-GCM via the platform Web Crypto implementation before they are stored. AES-GCM is authenticated encryption: tampered ciphertext fails to decrypt rather than silently returning wrong data.
You authorise on your broker’s own site
Connecting Alpaca is an OAuth handover. You approve access on Alpaca’s domain and we receive a scoped token. Your brokerage password is never typed into ONYX and never passes through it.
You can disconnect at any time
Revoking a connection removes our stored token. Anything automated that depended on it stops with it.
Seeing what happened
Recent activity
Security-relevant events on your account are recorded and visible to you in Settings → Security, so a change you did not make is something you can actually notice.
What we can see
We do not store your full payment card details — billing runs through Stripe. See the Privacy Policy for the complete list of what is collected and why.
Protocols that can act
You configure the rules; you are responsible for them
Automated protocols execute according to rules you write. They do only what those rules say, and reviewing them is your job — which is exactly why paper trading is the default and live execution is opt-in per portfolio.
Simulated results are not real results
Backtested and paper results are hypothetical. They do not reflect real fills, slippage or liquidity, and past or simulated performance does not indicate future results.
Reporting a vulnerability
If you believe you have found a security issue, please tell us before disclosing it publicly. We would rather hear about it early and will not pursue action against good-faith research.
Contact us