Data, custody & security

Who it’s for

Users deciding what to connect, and reviewers assessing what the platform can reach

Assumes

Nothing

Two questions matter here, and they have different answers: what does Stretus hold, and what can Stretus reach.

Custody: Stretus holds no funds​

Your money and your securities are held by your broker or your exchange, throughout. There is no Stretus wallet, no pooled account, no client ledger of holdings, and no mechanism to move value between users or out of the platform.

The consequence worth stating: Stretus failing does not put your capital at risk of misappropriation, because it never has it. What Stretus failing does risk is a strategy that cannot place an exit order, an availability problem, not a custody one. See Risk disclosure.

Credentials: what is stored and how​

To place orders on your behalf, Stretus stores what the venue requires.

Secrets that must be recoverable (an exchange secret has to be presented to the venue, so it cannot be one-way hashed) are sealed at rest with authenticated encryption (AES-256-GCM) under a master key held outside the database, and opened only in memory at the moment of use. Tampering with a sealed value causes it to fail to open rather than to decrypt into something wrong.

The permissions to grant, and the one never to grant​

When you create an exchange API key for Stretus:

• Grant spot trading, and reading balances and orders.
• Do not grant withdrawal permission. Not to Stretus, not to any third-party service. Stretus has no withdrawal code path and no reason to hold that scope.

If your exchange supports restricting a key to source IP addresses, use it, and allowlist the egress IP Stretus assigns you. See Connect a broker.

Outbound network identity​

Orders leave the platform from a controlled egress path, and your account can be assigned a static egress IP so exchange IP allowlisting is workable. This is the same mechanism that makes a locked-down API key usable, which is why it exists.

Tenant and account isolation​

The platform is multi-tenant. Data is scoped per tenant at the database level, with row-level security applied to shared reference tables and a dedicated canary service that continuously verifies the isolation holds rather than assuming it.

Within a tenant, your strategies, chats, capital allocations and deployments are scoped to your identity. A publisher cannot see a subscriber's account. A subscriber cannot see a publisher's other strategies.

What Stretus can see about your trading​

A publisher never sees any of this for a subscriber. Support and platform administration access exists for operating the service and is scoped and audited; it is not visible to other users.

Consent records​

Two actions on the platform write a durable consent record because both need to be provable later:

Open Strategy publishing. Choosing to disclose your strategy logic records the legal document version you were shown, a hash of the exact prompt text you licensed, your IP and your user agent. The prompt hash matters because the strategy prompt regenerates when the configuration changes, without it the record would only prove that some prompt was licensed. See Open Strategy.

Telegram notification binding. Linking a Telegram chat is opt-in, recorded, and revoked automatically if you block the bot. See Notifications.

Research Analyst documents​

Documents uploaded during Research Analyst onboarding go to encrypted object storage via a presigned URL, the file content does not pass through the application. Each document carries its own verification status, and the set is visible to the reviewing broker for the purpose of the review. See Research Analyst programme.

Deleting things​