Your broker. Your account. Your control.
Mcode is designed so that you stay in charge of your funds and your credentials at every step. Here is how we think about security.
Your credentials stay with you
When you connect MT5, authentication is handled through the broker’s official flow. We do not store broker passwords or access tokens on our servers.
Software, not a broker
Mcode is an analytical tool. We do not hold client funds, do not custody assets, and do not execute trades on your behalf. Orders originate from your account and execute at your broker.
Encryption in transit and at rest
All traffic is served over TLS. Data stored in our backend is encrypted at rest using industry-standard encryption provided by Supabase.
Row-Level Security
Every table that holds user data is protected by Row-Level Security policies enforced at the database layer. A user can only read and write their own records.
Least-privilege backend
Server routes run with scoped, short-lived keys. Service-role access is limited to specific operations that cannot be performed safely on the client.
Transparent policies
Read how we handle your data in our Privacy Policy, how you use the service in our Terms of Use, and what you should know about trading risk in our Risk Disclosure.
Common questions
Do you store my MT5 password?
No. Broker authentication is handled through the broker’s own flow. We only store connection metadata that is needed to route orders and display your account in Mcode.
Can Mcode move money out of my account?
No. Mcode sends order instructions to your broker; your broker executes them inside your account. We never initiate withdrawals or transfers.
What happens if someone gets access to my Mcode account?
They would be able to place trading instructions inside your broker account. That is why we recommend using a unique password for Mcode and enabling any additional security features your broker offers. If you suspect unauthorized access, contact us immediately and revoke the broker connection from your dashboard.
Where is my data stored?
Data is hosted on Supabase infrastructure. See our Privacy Policy for details on third-party processors and data retention.
Have you been audited?
We do not currently hold a third-party security certification. We follow industry best practices and are happy to discuss our security posture with enterprise customers on request.
Questions about security?
We're happy to walk enterprise users and prospective partners through our security posture in detail.